Proximity cards operating at 125 kHz do not support encryption, mutual authentication, or any cryptographic handshake with the reader; they simply broadcast a fixed facility code and unique card number over RFID, and all security logic lives downstream in the access control panel [S1][S3].
Smart cards carry an embedded microchip, either contact (ISO/IEC 7816) or contactless (ISO/IEC 14443, with NFC compatibility on the 13.56 MHz band), that performs on-card encryption, secure key storage, and challenge-response mutual authentication before the reader learns anything useful [S1][S3][S4].
What Each Credential Actually Does on the Wire
On a 125 kHz proximity reader the transaction is one-way and unencrypted: the reader's electromagnetic field energises the card's simple antenna coil, the card modulates its embedded ID, and the panel decides whether to unlock [S1][S3]. The HID 1386 prox card is the canonical example, and because the ID never changes, a $20 cloner can copy the credential in seconds [S1][S6].
On a 13.56 MHz contactless smart card the transaction is two-way and cryptographically protected: the reader issues a random challenge, the card signs or encrypts the response using a key that never leaves the chip, and the reader (or a SAM inside it) verifies it before the door controller ever sees a card ID [S2][S3][S4]. Smart cards can additionally store biometric templates, digital certificates, and cashless-payment credentials on the same chip, which is why one credential can serve parking, logical access, and vending [S4].
Decision Matrix: Four Criteria Lined Up
Security: smart cards win outright. Their tamper-resistant chips, mutual authentication, and support for multi-factor workflows defeat the cloning and replay attacks that flatten 125 kHz prox deployments, and they meet the PIV, CAC, and FIDO-aligned credential expectations now standard in federal and healthcare procurements [S1][S2][S4].
Cost: prox cards and prox readers are roughly 30 to 60 percent cheaper per door than smart card equivalents, with 125 kHz readers commonly landing under $100 and the cards themselves well under $5 each at volume, versus 13.56 MHz smart card readers that often run $150 to $400 and credentials at $3 to $15 [S4][S5].
Integration: smart cards plug into logical access, SSO, and secure print stacks through standards like PC/SC and CCID, while prox cards stay bolted to the door panel, useful but limited [S1][S3][S4]. For a deeper look at total installed cost, the per-door price bands in access control per-door cost guide break down where the budget actually goes.
Use case fit: prox suits interior doors, turnstiles, and low-sensitivity gates where a lost card is a nuisance rather than a breach; smart cards are required for high-security vestibules, server rooms, and any door that the mantrap interlock spec governs, and they also need to be paired with proximity probe or Wiegand-compatible readers to avoid forklift upgrades.
What Proximity Cards Are Good For, Honestly
Prox cards remain a reasonable choice for low-risk interior doors, parking gates, elevator floor selection, and gym or amenity access where the threat model is "keep the door closed," not "defeat a motivated attacker" [S1][S5]. They read fast (typically under 200 ms at 2 to 15 cm), survive five-plus years of badge-swipe abuse, and pair with legacy Wiegand panels that are too expensive to forklift [S1][S3][S5].
For budget-constrained retrofits on sites that already run HID Prox, the math usually favours staying on 125 kHz until a security incident, a compliance audit (HIPAA, PCI-DSS, CMMC), or a logical-access requirement forces the migration [S1][S4]. Readers like the WAVE ID family accept both prox and smart cards in the same housing, so sites can run a mixed population during transition without re-cabling every door [S1].
What Smart Cards Buy You, and What They Don't
Smart cards buy genuine cryptographic authentication, on-card biometric matching, and the ability to consolidate physical access, logical access, cashless payment, and secure print on one credential, all of which lower the long-term attack surface of a smart camera-monitored or PIV-mandated site [S1][S2][S4]. They are also the only credible option for organisations subject to NIST SP 800-73 PIV, DoD CAC, or FIDO2 credential expectations [S2][S4].
What they don't buy is automatic compliance. A smart card on a 4-digit PIN still fails if the PIN is shared, and a contactless smart card left on a desk is still vulnerable to a relay attack unless the reader enforces distance-bounding checks [S2][S3]. Compared with biometric-only doors, smart cards are also weaker in tailgating resistance, which is why card vs biometric access control is now the more common high-security decision than prox vs smart.
When Prox Cards Are the Wrong Choice
Prox is the wrong choice for any door protecting regulated data, any site handling cardholder data under PCI-DSS, and any facility whose insurer has begun rejecting 125 kHz credentials in writing [S1][S4]. The same logic applies to multi-tenant offices where one tenant's prox card grant could be cloned to access a neighbour's suite on a shared Wiegain bus [S1].
If the deployment is greenfield, skip prox entirely. New installations should default to 13.56 MHz contactless smart cards (iDESFire EV2/EV3, SEOS, or PIV/CAC variants) with OSDP-SCP wiring to the panel rather than Wiegand, which is itself an unencrypted, one-wire protocol that has no place in a 2026 spec [S3].
Migration Path and Trackable Signals
A staged migration typically starts by replacing prox-only readers with dual-frequency units that read both 125 kHz and 13.56 MHz, re-issuing smart cards over a 12 to 24 month credential refresh cycle, then decommissioning the prox side of each reader once issuance is complete [S1][S4]. Track the rollout by monitoring the percentage of 13.56 MHz events in the access control logs versus legacy 125 kHz reads, and watch for the next OSDP-SCP mandate in your vertical, since that is the inflection point where vendors stop offering prox-only controllers.
Detailed specification references: access control.