Are Mobile Credentials Secure for UK Businesses?

A facilities manager can cancel a lost plastic card quickly. A lost phone, however, can feel like a more complicated security event: it contains a credential, may hold business data and is used beyond the perimeter of the building. So, are mobile credentials secure? When they are designed, deployed and managed correctly, they can be at least as secure as conventional cards - and often give organisations far better control over access.

The answer is not that every phone automatically becomes a secure key. Security depends on the credential technology, the reader configuration, the mobile device’s protections and the procedures behind the system. For commercial and industrial sites, mobile access should be treated as a managed part of the wider physical security infrastructure, not simply as a convenient replacement for a fob.

Are mobile credentials secure in practice?

A properly implemented mobile credential is not a copied card number stored openly on a handset. Modern systems use encrypted communication and cryptographic keys to establish that the phone and reader are authorised to interact. The credential is held in a protected area of the device or within a secured application environment, rather than being presented as a simple static identifier.

This matters because static identifiers are easier to copy, share or replay. Stronger mobile credential platforms use secure key exchange, mutual authentication and credential-specific encryption. The reader does not merely ask for a number; it verifies a trusted digital credential before releasing the door.

For an organisation, the operational advantage is equally significant. Access permissions can be issued, amended or withdrawn centrally, without collecting and reprogramming cards. A contractor can receive access for a defined job and time period. A departing employee’s rights can be removed immediately. Across multi-site estates, this reduces the risk created by credentials that remain in circulation after roles, shifts or supplier arrangements change.

Mobile credentials also create a clearer opportunity to require a second factor. The phone itself is one possession factor, while the device passcode, fingerprint or facial recognition supplies a further check. Whether that extra step is required at every opening is a risk decision. It may be appropriate for a cash room, plant area, data room or secure archive, but unnecessarily slow for a busy staff entrance.

The risks do not disappear - they change

Physical cards can be lost, loaned, cloned or left active in a drawer. Mobile credentials reduce some of those problems, but introduce others that need active management.

The most obvious concern is the lost or stolen phone. A device protected by a strong passcode and biometric authentication presents a very different risk from an unlocked, unmanaged handset. Organisations should define what happens when a user reports a device missing: who can suspend the credential, how quickly that action is taken and how the user regains access safely.

A second concern is device integrity. Rooted or jailbroken devices, outdated operating systems and unofficial app stores can weaken the security controls that mobile credentials rely on. A suitable access policy should define supported operating systems and minimum versions, and should prevent use on compromised devices where the platform supports this.

There is also a human factor. A phone can be handed to a colleague just as a key card can. Sensitive openings should therefore be supported by the right door hardware, access rules, CCTV coverage and, where appropriate, anti-passback or monitored entry procedures. A mobile credential proves that an authorised device requested access. It cannot, by itself, guarantee that the person entering is alone or acting within their authority.

Technology choices affect the level of assurance

Not all mobile access methods provide the same experience or security characteristics. Near-field communication (NFC) typically requires the phone to be close to the reader. This deliberate proximity can suit higher-security openings where the user should make an intentional presentation.

Bluetooth Low Energy (BLE) can support hands-free or longer-range access. It is useful where staff are carrying equipment, moving through controlled doors frequently or entering vehicle gates. The convenience is valuable, but reader range and opening behaviour must be carefully configured. A door should not release simply because an authorised phone is somewhere nearby on the other side of a wall or in a passing vehicle.

Some systems also support wallet-based credentials, while others operate through a dedicated mobile application. The best choice depends on the estate, user population, device policy and required workflow. A public-facing building may prioritise simple visitor enrolment. A pharmaceutical, financial or industrial environment may favour tighter device controls, explicit user interaction and detailed audit trails.

The reader and lock are just as important as the phone. A modern credential cannot compensate for an exposed request-to-exit device, poor door alignment, inadequate locking, an unprotected communications cabinet or a fire-door installation that has not been correctly specified. Access control works as a system: credential, reader, controller, door hardware, network, power resilience and management platform all need to support the required level of protection.

Cloud management can improve control, if governance is clear

Cloud-connected access control enables authorised managers to manage permissions across sites without being physically present at each location. It can shorten the response to lost devices, emergency access changes and contractor movements, while giving security teams a central record of events.

That visibility is valuable, but it should be governed properly. Define who can create credentials, approve access groups, alter opening schedules and export audit information. Use named administrator accounts, multi-factor authentication and role-based permissions. Review administrator access when responsibilities change, particularly where facilities, IT, HR and security teams share management duties.

Audit records should support investigation rather than create noise. Focus on meaningful events: denied access attempts at critical doors, out-of-hours entry, repeated credential failures, use of emergency overrides and unexpected changes to permission sets. Integration with CCTV or visitor management can give those events useful context and help teams respond proportionately.

For UK organisations, privacy also deserves attention. Access events can reveal working patterns and movements. Retention periods, legitimate purposes for monitoring and access to reporting should be established in line with organisational policy and data protection obligations. Clear communication with employees is both good governance and good operational practice.

A secure deployment starts with the door, not the app

The strongest mobile credential project begins with a site and risk assessment. Identify which doors need convenience, which need a higher level of assurance and which need additional physical measures. A staff car park barrier, warehouse personnel door, reception turnstile and server room should not necessarily operate in the same way.

Next, establish the lifecycle of each credential. Consider how employees are verified before enrolment, how temporary workers are approved, whether personal devices are permitted, what happens when a handset is replaced and how leavers are removed. These questions are often more consequential than the choice of handset model.

A well-designed deployment should include the following controls:

• Encrypted, securely issued credentials from a recognised access-control platform.

• Device passcode and biometric requirements appropriate to the risk of each access area.

• Rapid suspension and revocation processes, tested by the people responsible for them.

• Defined policies for unsupported, compromised, shared or personally owned devices.

• Role-based administration, multi-factor authentication and routine review of access rights.

• Correctly specified locking, readers, emergency egress and door monitoring.

Testing is essential before rollout. Trial the system with real user groups, including shift workers, visitors, contractors and staff who work in areas with limited mobile coverage. Confirm how doors behave when the phone battery is low, the device is offline, the network connection is interrupted or a user has changed handset. Resilience is not an optional technical detail in a live operational environment.

Where mobile access delivers the greatest value

Mobile credentials are particularly effective where organisations issue and recover large numbers of cards, manage multiple locations or regularly provide controlled access to contractors. They can simplify access for estates teams while improving accountability at the point of entry.

They are not always the only answer. Some sites need physical cards for visitors without compatible devices, contingencies for staff who cannot use a smartphone, or credentials suited to harsh environments where phones are impractical. A mixed model is often sensible, provided every credential type is governed through one clear access policy.

As a SALTO access-control specialist, Loktec Security Group approaches mobile access as part of a complete security design: the credential must work with the door, the people using it and the operational response behind it. The goal is not to replace a card with a phone for its own sake. It is to give authorised people the right access at the right time, while making every unnecessary route into the estate harder to exploit.

The most secure mobile credential is one that your organisation can issue confidently, monitor intelligently and withdraw without delay. Get those foundations right, and mobile access becomes a practical way to strengthen control while reducing the everyday burden of key and card management.