Card, biometric or mobile credential: choosing an access-control system.

The credential-type question — card, biometric or mobile — usually gets decided on general preference, when the honest answer depends on what a specific entry point actually needs to handle.

Card and fob credentials

Well understood, inexpensive per-credential, and simple to issue and revoke. Their weakness is that a card can be lent, lost or cloned depending on the technology used — the system verifies possession of the card, not identity of the person carrying it.

Biometric credentials

Verify something about the person directly — fingerprint, face — removing the “lent credential” problem entirely. They cost more per reader, can be slower at high-traffic entry points, and require a clear policy for enrolment, data handling and what happens when biometric matching fails (illness, injury, environmental conditions).

Mobile credentials

Use a smartphone as the credential, often over Bluetooth or NFC. Convenient for users who already carry their phone everywhere, and easy to revoke remotely. They depend on users keeping devices charged and the app functional, which matters for entry points that can’t tolerate failure.

The question that actually decides it

Rather than picking one credential type for an entire site, the more useful question is: what does this specific entry point need to handle? A high-traffic staff entrance has different priorities — throughput, low friction — than a server room or a restricted area, where verified identity matters more than speed. Many well-designed systems mix credential types by zone rather than standardising on one for every door.

What matters beyond the credential itself

• Enrolment and offboarding process — how quickly can access be granted or revoked, and is that process actually followed when staff join or leave?
• Audit trail — can you answer “who accessed this door, and when” after the fact?
• Integration boundary with CCTV — is an access event correlated with a camera event, without merging the two systems into a single point of failure?

The credential type is one decision among several. Getting the enrolment, revocation and audit process right usually matters more to actual security outcomes than which reader technology sits on the wall.