How Hackers Clone RFID Cards in Under 60 Seconds — The Hardware They Use

How RFID Access Cards Work — and Why Old Ones Are Trivially Cloneable

RFID (Radio Frequency Identification) access cards work through electromagnetic induction. When a card enters the reader’s radio frequency field, the reader’s antenna transmits enough RF energy to power the card’s passive microchip. The chip wakes up, reads a unique identifier stored in its memory, and broadcasts that identifier back to the reader. The reader receives the identifier, looks it up in the access control database, and decides whether to unlock the door.

The security of this system depends entirely on the identifier being secret. In 125kHz systems, it is not secret at all. The card broadcasts its identifier in cleartext to any powered reader within range, using no authentication handshake and no encryption. The assumption in 1990 was that card readers were expensive and controlled. Today, a reader capable of capturing that identifier costs $20 and arrives in a regular-sized postal envelope.

The Real Hardware — Proxmark3, Flipper Zero and What They Cost

The Proxmark3 is the professional standard for RFID security research and physical penetration testing. It reads and writes virtually all common RFID card types, supports standalone operation for field use, and has an active community producing new attack modules. A Proxmark3 RDV4 (the current version) costs approximately $320. It handles 125kHz read/write, 13.56MHz read/write, MIFARE Classic key cracking, and advanced ISO14443/15693 protocol attacks.

The Flipper Zero became the widely-recognised tool in this space after 2022 due to its pocket-size form factor and multi-protocol capability. It reads and copies 125kHz cards (EM4100, HID Prox), reads 13.56MHz NFC cards and performs basic MIFARE Classic operations, and includes sub-GHz radio for additional wireless protocol testing. At approximately $169, it became the accessible entry point for physical security research. It does not have the full attack capability of the Proxmark3 against hardened 13.56MHz cards but covers the vast majority of real-world corporate access cards in use today.

The Physical Attack — What Actually Happens in 60 Seconds

A typical 125kHz RFID cloning attack during a physical penetration test involves four steps. First, the tester positions a concealed reader — either a Flipper Zero in a jacket pocket or a purpose-built long-range reader in a bag — near a target employee. Second, the reader broadcasts an activation signal and captures the card’s response (UID broadcast) when proximity is established. Third, the captured UID is written to a blank T5577 card (a writable 125kHz card that can be programmed to emulate any 125kHz card type). Fourth, the clone card is presented to the target building’s access reader.

The entire process — from initial read to having a working clone — takes under 60 seconds with practised technique. The original card is never physically handled. The employee whose card was cloned has no indication that anything occurred. The building’s access control logs show two entries: the original card entering, and later the clone entering. Without anti-passback controls comparing entry and exit logs, neither event appears anomalous.

Advanced Attacks — MIFARE Classic Sector Key Extraction

MIFARE Classic cards use the Crypto1 cipher for sector authentication — a proprietary algorithm designed by NXP in the 1990s that was reverse-engineered by security researchers in 2008. Two practical attacks exist: the Darkside attack (works against cards with at least one known sector key, recovers other keys) and the Nested attack (after one key is known, recovers remaining keys extremely quickly). Proxmark3 with the Iceman firmware implements both attacks and can extract all 16 sector keys from a MIFARE Classic 1K card in 2-10 minutes, after which the card can be fully cloned to a blank writable MIFARE Classic card.

The Only Defences That Work Against RFID Cloning

There are exactly two hardware defences and several procedural defences. On hardware: replace 125kHz cards with MIFARE DESFire EV2 or iCLASS Elite technology (mutual authentication with AES-128 that has no practical cloning attack); and add PIN pads to access readers for multi-factor physical access (a clone card without the PIN is useless). On procedure: implement anti-passback controls that detect the same card ID entering twice without an exit record between the entries; deploy access log monitoring with alerts for unusual entry patterns; and brief employees on the close-range read risk of 125kHz cards.

RFID-blocking wallets provide personal protection against opportunistic reads — they use a Faraday cage to block RF signals. They do not protect against targeted attacks where an employee is specifically targeted at the moment they present their card to a legitimate reader, because the card must leave the blocking wallet to be used. True defence requires hardware upgrades, not accessories.