RFID Data Security in India (2026): Is RFID Safe? Cloning, Skimming & Encryption Explained

If you are deploying RFID for access control, asset tracking or payments in India, one question comes up in every procurement meeting: is RFID actually secure, or can anyone with a cheap reader clone my cards? This guide is for Indian facility managers, IT security teams and business owners who need a straight answer on RFID cloning, skimming, encryption and mutual authentication, plus practical steps to protect access cards and tags.

Is RFID safe? The honest answer

RFID is not inherently secure or insecure. Security depends on the chip type, the frequency and how the system is configured. A basic 125 kHz low-frequency access card and a properly configured DESFire EV3 card both say "RFID" on the datasheet, but the first can be cloned in seconds with a device bought online, while the second is built to resist cloning with AES-based mutual authentication.

The problem in India is that many offices, gyms and apartment complexes still run 125 kHz LF cards or MIFARE Classic, both broken from a cryptographic standpoint, simply because they are cheap and "just work".

There are three real-world threats to design against:

• Cloning: duplicating a card's ID or memory onto another card.
• Skimming: reading a card covertly, at a distance.
• Replay and eavesdropping: capturing the radio conversation and replaying it later.

The good news: each of these is defeatable with the right chip and configuration.

How RFID cloning and skimming actually work

Cloning

Cloning copies a card's unique identifier or memory contents onto a blank card. For a 125 kHz LF EM4100 card this is trivial: an inexpensive handheld duplicator reads the ID and writes it to a T5577 blank in under ten seconds.

MIFARE Classic 1K, despite using encryption, was broken years ago. Its Crypto-1 cipher can be cracked with free software and a Proxmark device, exposing all keys and letting an attacker clone the full card.

Skimming

Skimming is reading a card without the holder's knowledge. LF and HF (13.56 MHz) cards have a short read range, typically under 10 cm, which limits skimming to close contact (a crowded lift, a bag brushed against a reader).

UHF cards, by contrast, can be read from 1–8 metres, so an unshielded UHF access card in a wallet is theoretically readable across a room. This is why UHF is rarely used for high-security personnel access, and why range is a security parameter, not just a convenience one.

Replay and eavesdropping

If the card and reader exchange data in plaintext, an attacker with an SDR or Proxmark can record the exchange and replay it later. Systems that only check a static ID (LF cards, UHF EPC without added crypto) are wide open to this. Systems using challenge-response mutual authentication are not, because every session uses a fresh random challenge.

Encryption and mutual authentication: the real defence

The most important security feature is mutual authentication. The card proves to the reader that it knows a secret key, and the reader proves the same to the card, before any data is exchanged, using random numbers so no two sessions look alike. This defeats cloning, replay and man-in-the-middle attacks in one stroke. Modern secure cards pair it with AES-128 encryption of the data itself.

NXP's MIFARE DESFire EV2/EV3 is the workhorse in Indian deployments. It supports AES-128 and 3DES, mutual authentication, and multiple isolated applications on one card, so your access-control key and your cafeteria-payment key never touch each other. For payment-grade or national-ID-grade needs, chips add secure messaging and Common Criteria certification.

UHF EPC vs secure HF: choosing by use case

This is where most Indian buyers go wrong. UHF (EPC Gen2) is optimised for long read range and reading hundreds of tags per second, which is ideal for warehouse inventory, retail stock counts and vehicle gate access. But standard EPC memory is essentially an open, readable serial number: excellent for logistics, poor as a secure credential on its own.

• Use UHF EPC for asset tracking, warehouse and supply-chain visibility, apparel and retail inventory, and toll or parking gate reads, where speed and range matter and the "secret" is not the tag ID itself. See our UHF RFID tags for these deployments.
• Use secure HF (DESFire) for people access control, cashless campus and cafeteria payments, membership, and any credential where cloning must be prevented. Browse HF cards (MIFARE Classic, DESFire, NTAG) in the RFID cards range.
• Never secure a building purely on an LF card if it protects anything of value. Treat LF as a convenience token, not a security credential.

If you genuinely need long range plus security, for example anti-counterfeit tagging of high-value goods, UHF Gen2v2 with cryptographic authentication and untraceable mode is the answer, though it costs more and needs compatible readers.

What security costs: the relative picture

Security is affordable when scoped correctly. In relative terms, from cheapest to dearest per unit:

• UHF EPC inlay labels: the lowest cost per unit; hard and on-metal UHF tags cost more.
• 125 kHz LF cards: cheap, but insecure.
• MIFARE Classic 1K cards: slightly dearer than LF; avoid for new secure projects.
• MIFARE DESFire EV3 cards: several times the cost of a Classic card, depending on memory and volume, and the sensible secure default.

List prices for each card and tag are shown on the product pages, with quantity pricing where it applies.

The card is only half the system. A DESFire card is useless if your RFID reader and panel are configured to read only the open UID, a surprisingly common mistake. The reader must be provisioned with your keys and set to authenticate against a protected file; otherwise you are paying for a secure card and using it as an insecure one.

A practical checklist to protect your access cards and tags

• Specify DESFire EV2/EV3, not MIFARE Classic or LF, for any new access-control or payment project.
• Read a protected, key-authenticated file, never the raw UID. Insist your integrator provisions custom AES keys; never ship default keys.
• Manage keys properly: use diversified keys (a unique key per card derived from a master key), and store master keys in a SAM or secure module, not a spreadsheet.
• Match frequency to risk: HF/DESFire for people and payments; UHF for assets and logistics.
• Lock down UHF tags: set access and kill passwords and lock the memory banks before tags go into service.
• Shield high-risk credentials with RFID-blocking sleeves, and keep read ranges as short as the application allows.
• Use on-metal or specialty tags correctly in industrial settings so tags perform reliably. See on-metal RFID tags.
• Check approvals: UHF readers in the 865–868 MHz band need WPC Equipment Type Approval for the model; ask for the ETA and any BIS registration of the exact model you buy.

Buying secure cards and readers in India

Grey-market cards are a real security risk: if you do not know the exact chip, or who holds its keys, you cannot trust the credential. Ask for the chip type in writing on every card order, test sample cards against your reader before a volume order, and keep key provisioning under your own control or your integrator's.

India RFID Store (Identium Tech Solutions, New Delhi) makes and supplies LF, HF and UHF cards, tags and readers, so the card and the reader can be matched and tested together. In our reader range, the CX1500N, IF9A, IHZ4 and MUBR01 hold WPC ETA, and BIS registration covers ten reader models including these.

To scope a secure deployment, browse HF cards and HF RFID readers, or request sample cards to test with your existing access-control readers.

Related guides

• RFID cards explained: UHF vs HF vs LF vs MIFARE
• RFID access control system: how to set up door access
• Impinj vs NXP RFID chips
• NFC vs RFID: what's the difference?
• DPDP Rules vs biometric attendance: the RFID alternative