A few centimetres for a compact reader up to roughly a hand's width for a larger one - and less than the datasheet says once it is mounted.

Range is set by antenna size, so physically larger readers read further. That is the main reason to choose one over another for the same technology.

Metal mounting is the biggest reduction. A reader fixed directly to a metal frame or mullion can lose most of its range unless it is a model designed for the job with an isolating spacer behind it.

Credential form factor changes it too. A card, a fob and a wristband present different antennas and read at different distances from the same reader.

Nearby readers interfere. Manufacturers publish a minimum separation and it matters most in banks of turnstiles.

If genuine distance is the requirement - a vehicle lane, a hands-free door - that is a long-range reader, not a bigger proximity one.

Yes, easily. The credential transmits a static number with no authentication, and copying devices are inexpensive and widely sold.

The technology was designed when the realistic threat was a borrowed or lost card, not a pocket-sized cloner. There is nothing in the protocol to prevent duplication.

A copy is indistinguishable from the original at the reader and in the audit trail, which is the more serious consequence: the log will name the legitimate cardholder.

Treat it as a known limitation with a managed response rather than a reason for alarm. Most sites live with it for a period while they migrate.

The mitigations that work are a second factor at high-value doors, tighter monitoring of unusual access patterns, and a dated plan to move to authenticated credentials.

The mitigation that does not work is keeping the format secret. Formats are widely documented and obscurity protects nothing.

Only to match credentials already in circulation. For anything genuinely new, specify an authenticated smart or mobile credential instead.

There is no cost argument strong enough to justify installing a knowingly copyable credential technology on a new site.

The legitimate case is an extension to an estate with a large existing card population, where reissuing everything at once is impractical.

Even then, specify multi-technology readers. The incremental cost is small and it turns the eventual migration from a rip-out into a reissue.

Set an end date for the legacy format. A reader that accepts both indefinitely provides the security of the weaker one for as long as it is enabled.

Where a site is genuinely constrained, prioritise the doors by consequence and migrate those first rather than working geographically.

It is the structure of the data on the credential - typically a site or facility code plus a card number - and the reader has to understand the one in use.

Formats differ in bit length and in how the fields are arranged. A reader configured for one will not correctly interpret another.

This is the most common cause of a new reader failing to work on an existing site: the hardware is fine and the format is wrong.

Record the format, the facility code and the number range in the system documentation. It is needed for every future order and every reader replacement.

Some formats are proprietary to a manufacturer and controlled, which limits where credentials can be bought. Others are open and available from many suppliers, at the cost of anyone being able to order a matching card.

When ordering additional credentials, always quote the format and the last number issued rather than leaving the supplier to choose.

Yes, but only with a reader designed for metal mounting - a standard one loses most of its range and may not read at all.

Metal behind an antenna absorbs and detunes the field. The effect is severe rather than marginal.

Manufacturers publish mullion or metal-mount versions with a compensated antenna and often an integral spacer. Use those on frames, mullions and metal door leaves.

A non-conductive spacer helps a standard reader but rarely restores full range, and it leaves the reader standing proud of the surface.

The same applies to what is behind the wall. A reader on plasterboard with a metal stud or foil-backed insulation immediately behind it behaves like a metal-mounted one.

Test on the actual surface before committing the whole site. Range measured on a bench predicts very little.

Traditionally over a simple one-way data pair, which is unsupervised and unencrypted - which is why a supervised, encrypted protocol should be specified where the reader supports it.

The legacy interface sends the credential number to the controller in clear with no acknowledgement and no monitoring of the link.

That means anyone who can reach the cable behind the reader can capture numbers or inject their own, and the controller cannot tell.

Modern readers support a bidirectional supervised protocol with encryption of the reader-to-controller channel and detection of a cut or substituted reader.

It also allows several readers on one bus, which reduces cable on large installations.

If the estate must stay on the legacy interface for now, keep the cable inside the secure area, use a reader with a monitored tamper switch, and put the controller somewhere it cannot be reached.

They stop reading - so the door's behaviour depends entirely on the lock type and the standby supply, not on the reader.

A reader with no power presents no credential to the controller, so nobody is granted access through it.

Whether the door is open or shut then depends on the lock. Fail-safe locks release without power; fail-secure locks stay locked.

Escape from the secure side must not depend on any of this, which is why the exit side carries its own devices and an emergency release wired to break lock power directly.

Standby batteries in the access control panel are sized to cover readers and locks for a defined period. That figure comes from the local standard or the insurer, and the battery should be specified at end-of-life capacity.

Test the standby supply on a schedule. A battery that has quietly failed is only discovered during the outage it was bought for.