Duplicating Condominium Access Cards

17 December 2015

I lost my access card to my apartment the other day.  The management of the Condominium  wanted SGD$60/= for the replacement of the card and another $100/= as a deposit.  The market rate to duplicate a card ranges from $15/= to $33/=.  This article will give some basics about access card and where and how I duplicated my card.

The Basics

Most access cards used in Condominiums are for access through the main or side gate.  These cards are called “RFID” cards which stand for Radio Frequency (RF) ID Cards.   Embedded inside each card is a coil of thin wires and a microchip.  Most of these cards are passive type,  meaning there is no battery inside the card. 

 

When the card gets near a card reader,  the coil  will receive an RF signal from the card reader. This signal will not only power up the card but also activate the microchip inside the card to send a code to the card reader to open the gate for example.

Some of the cards are encrypted for additional security reason,  making them difficult to clone.  Fortunately or unfortunately,  most cards are simple cards that just stored an ordinary code for the card reader.

The simple ones will use a frequency of 125Khz as a transmitting carrier.  Some complicated ones that allowed codes to be encrypted are running at 13.56 Mhz which will allow more codes to be written to the cards.     

How to Duplicate EM Cards

1.  Non Encrypted EM Cards

These cards are  called “EM” cards as it was first developed by EM Microelectronic of Switzerland.  They are labelled EM4100 or EM4102 and they work only on 125Khz frequency. EM cards also operate at some other frequencies. 

2  What you will need to duplicate EM Cards?

      1. EM Card Reader Cum Writer (copier)

      2. EM card or EM tag

  

      One can purchase the EM card reader cum writer (copier) from vendors in AliExpress for about USD $15/=.  This EM copier also supports EM4205,4305 writable cards or tags as well as T5557,  T5567, T5577,  CET5200 and CET5577 cards as described in the  brochure.  The complete set comes with 6 credit card size EM cards and also 6 RFID tags as shown below.

 

The reading  and writing of the card is very simple as shown in the following video.

How To Identify Your Card?

Many cards do not give any clue about what type and model;  fortunately,  there is a simple way to find out because most card readers will have a brand name and sometimes,  if one is lucky,  also the  model number.  Surf the net to get the required information.

What if my RFID is not the same type as yours?

 Like any lock or key,  all access cards can be hacked and duplicated.  One only needs to surf the net and find a solution.  If one's card is  simply having a single purpose such as opening the door or main gate,  it might not be encrypted and one is likely to find similar tools to read and write the card.  A good tool to use is a 9 frequencies copier as shown here.

This tool will try to read almost any card and give a voice in English that will report something about the  card,  such as operating frequency or if it can read and write your card.

What if all the above does not work?

 One may try to purchase another more expensive and powerful copier  such as this shown here. 

 

According to the description,  the copier will display the read and write operations.  For access card that is encrypted,  this copier can also be hooked up to a PC in which a software provided will be able to analyse the card and help to identify and crack the code.  However,  the author has not tried this tool yet.

Are there other tools?

There are many other tools available in the market that can read and write the card but most of these other ones will require one to know how to use the software and do some programming in order to duplicate or break the code.

Can I use EM copier for copying HID cards?

 Not all copier can copy both EM and HID cards although they are of the same frequency.   HID cards are just cards that is manufactured by another company.  HID card has a more advance coding system,  enabling more secured codes to be written to the card.  It is always good to check with the vendor if one suspected that their access card has more advance features.  Copiers that can copy both EM and HID cards demand a slightly higher price.

Is EM4100 and EM4102  the same?

EM4100 and EM4102 are the same type of card except for EM4102,   being newer model,  has a unique chipset configuration that will  enable the card to be made thinner than EM4100.  Please note that EM4100 is not programmable.  One could try EM4305 or other series of compatible  RFID cards or tags.

What about other EM cards and other 125 Khz Cards?

EM cards are not necessary made for the same purpose and therefore,  they may differ from each other.   EM4100 are 64 bits read only card that once written,  cannot be rewritten.   The other card like EM 4205 and 4305 are 32 bits, whereas T5557 are 330 bits types that may not be compatible with EM4100.  On the other hand,  EM4200,  being replacement of EM4100/EM4102 EM4005/4105 claimed to be compatible with the latter.

Is it legal to copy access cards?

Under the  existing legal framework,  duplicating access cards is treated no difference to  duplicating normal keys.  There are many shops and outlets including those  reputable ones like  Mister Minit and  Soxxi Master are offering such duplicating services.