IC access cards are common in access control because they are fast, contactless, and easy to hand to someone without a smartphone or an app account. They are also physical objects, which means they get lost, copied, or passed around, and most of the work of running them is keeping track of which card belongs to whom. The rest of this page covers how the cards work, then how to enroll, issue, duplicate, revoke, and audit them, whether the scope is one door or a whole property.
What the lock is actually reading
An IC (integrated circuit) card carries a tiny chip and antenna. Hold it near the reader and the reader's RF field powers the chip, which transmits an identifier — usually a unique serial number called the UID. The lock compares that UID against its allow-list and opens if it matches.
Two details shape how you manage cards:
- The lock trusts the UID, not the card's appearance. Two visually identical cards with different UIDs are two different credentials, which is why enrollment is the step that matters.
- Most residential and hospitality cards are read-only UID cards (Mifare Classic / Ultralight families). Higher-security deployments use encrypted sectors or mutual authentication, where the card and reader exchange a cryptographic challenge rather than a raw UID.
Gather these first
- The smart lock(s) you are issuing cards for, already installed and paired.
- A card encoder connected to a PC, or the encoder function inside the management app on a phone with NFC.
- Blank IC cards of the correct frequency (125 kHz or 13.56 MHz — match what your lock reads).
- The management app or PMS interface, with admin rights.
For the hardware itself, the card encoder and the smart lock lineup are listed separately.
Enrolling and issuing a card
- Put the lock into enrollment mode. In the app, open the door's device page and choose Add card (or Register card). The lock's reader enters a waiting state.
- Present the card. Hold the blank to the reader until the app confirms the UID was read — usually a beep or a green LED.
- Name the credential. Assign a label: the cardholder's name, a unit number, or a staff role. This is what you will see in the audit trail and the revoke list.
- Set validity (optional). For guest or temporary cards, set start and end times or a one-time flag here, exactly as you would for a passcode.
- Confirm enrollment. The lock writes the UID to its local allow-list. Test it: present again, confirm the bolt retracts and the event shows in the log.
- Hand over the card. Note the card's physical number (printed or engraved) alongside the cardholder, so a found card can find its way back.
Backups: enroll, don't clone
For a second card to the same person, you usually do not clone the UID onto a new blank. Cloning means both cards share one identity and one audit trail — if one disappears you must revoke both, and you cannot tell which one was used at the door.
Enroll two separate cards against the same door and same rules instead, each with its own UID and its own label ("Unit 4 — main", "Unit 4 — backup"). The audit log then shows which card opened the door and when. Reserve cloning for genuine emergencies, and only on encrypted cards where the clone carries the same sector keys.
Working at property scale
For a hotel or multi-tenant building, enrolling cards one at a time through the app is slow. Pair the card encoder with the property management interface:
- Batch-enroll blanks. The encoder reads a stack of cards and registers each UID against a unit or floor plan in one pass.
- Link to the PMS. With a PMS integration, check-in triggers card issuance and check-out triggers revocation automatically.
- Use card groups. Group cards by role (staff, resident, guest, service) so you can change rules for a whole group at once — locking out every guest card during an emergency, say — without touching each card.
- Audit per card, not just per door. Pull logs filtered by UID to follow an individual's movement.
When a card goes missing
A lost card is a live credential until you revoke it. Move immediately:
- Open the card list for the affected door.
- Find the card by label or printed number.
- Revoke (delete) the UID from the allow-list. With a gateway online this applies instantly; without one, it applies on the next sync.
- Issue a replacement as a new enrollment — not a clone.
- Pull the log for that UID across the period the card was missing, to catch any use you didn't authorize.
Keeping the list clean
Treat the allow-list as the source of truth. A card in a drawer is harmless; a UID in the list is a key, so prune the list when staff leave. Match card type to risk — plain UID cards are fine for low-risk interior doors, while encrypted cards belong on the perimeter and on sensitive areas. Audit periodically; once a quarter, export the list and check that every active UID still maps to a known, current person. For how card management fits into a broader security posture, the access control security best practices guide goes deeper.
The pattern holds through every step above: enroll each card as its own UID with a clear label, issue backups rather than clones, and revoke lost cards the same hour you notice them gone. Keep to that and the cards stay fast and contactless at the door, with an audit trail that still tells you who came and went.