Mobile access control is a setup in which an employee's or visitor's smartphone replaces the access card for doors, turnstiles and barriers. The phone is tapped on the reader via NFC (Near Field Communication), brought close over Bluetooth Low Energy (BLE), or displays a short-lived QR. Whatever the method, the central access system, not the phone, decides who gets in.
Key takeaways
- There are four ways to open doors with a phone: tapping via NFC, approaching over Bluetooth (BLE), a time-limited QR code, and remote unlock from an app.
- Phone NFC runs at 13.56 MHz; 125 kHz readers cannot see a phone at all, so a reader audit comes first.
- As of October 2026, Türkiye is not on Apple's NFC & SE Platform list; for iPhone users, time-limited QR or Bluetooth is more predictable.
- A phone entry log is personal data too; using personal phones should be voluntary and backed by a KVKK privacy notice.
- Every mobile access project needs a written fallback (card, PIN or temporary QR) and a two- to three-week pilot on one door.
Why is mobile access control in demand?
Demand for mobile access control grows out of the everyday friction of managing cards. Every organisation that runs card access knows the small daily frictions: the employee who left their card at home, the contractor waiting for a replacement, the visitor who walks off with a badge. Printing, issuing and collecting cards is an invisible workload. The phone, meanwhile, is the one device people almost never leave behind.
Phone ownership is not a barrier in Türkiye either. According to BTK's Quarterly Market Data Report for Q1 2026, the Turkish telecoms regulator counted 85.96 million real mobile users excluding M2M at the end of March 2026, a penetration rate of about 100.3%. The market is moving the same way: MarketsandMarkets' access control forecast expects the global access control market to grow from USD 10.62 billion in 2025 to USD 15.80 billion by 2030, driven by IoT-based security and cloud platforms.
So "can we open the doors with our phones?" now comes up in nearly every access project. It is a fair question, but the answer is not a single technology. Mobile access touches the reader hardware, the phone operating systems, network connectivity and data protection rules all at once. If you have not yet pinned down the building blocks of card access, start with our card access control system guide; mobile credentials sit on top of that structure.
What happens if mobile access is set up wrong? Three hidden costs
With a poorly planned mobile access rollout, the first cost is technical, and it comes from assuming the phone behaves the same everywhere. The iPhone is the clearest example. Apple has opened NFC card emulation to third-party apps, including corporate badges, through its "NFC & SE Platform". However, the list of eligible territories on Apple's NFC & SE Platform developer page does not include Türkiye as of October 2026, so an NFC scenario that works on Android may not work for the managers carrying iPhones.
The second cost is legal. Türkiye's Personal Data Protection Law No. 6698 (KVKK) is broadly modelled on EU data protection law, and the Personal Data Protection Board has listed examples of methods employers can use for attendance instead of biometrics:
In its public announcement on principle decision 2026/921, the Turkish Personal Data Protection Authority lists alternatives such as "encrypted card or PIN-based systems", traditional signed paper timesheets, "RFID/NFC ID cards" and manual entry under supervision. (KVKK announcement on decision 2026/921)
The Board's approach suggests that, for attendance, card credentials are seen as a less intrusive option than fingerprints. Phone-based methods that process no biometric data can be assessed in the same way; we cover the detail in biometric attendance and data protection. Phones still generate personal data, though. A log of which device was used at which door, and when, falls under KVKK and must be limited to its purpose and kept proportionate.
The third cost is operational and usually surfaces after go-live. Mobile access without a defined fallback means queues at the turnstile at shift change: flat batteries, apps that will not open and permissions wiped by an update all land on the security desk. Swapping card handouts for "my phone won't read" calls is a common disappointment with mobile access.
How does mobile access control work? NFC, BLE, QR and remote unlock
Mobile access, or phone-based door entry, can be built in four ways. The methods differ in how the phone talks to the reader and how much they depend on the network.
| Method | How it works | Strength | Watch out for |
|---|---|---|---|
| NFC (phone as card) | Phone is tapped on the reader; an app emulates the card credential | Closest to the card habit, fast | iPhone regional and contractual limits; reader must support it |
| Bluetooth (BLE) | App sends the credential when the phone approaches the reader | Entry without taking the phone out | Poorly tuned range can open doors unintentionally; battery and permission settings |
| Time-limited QR | A short-lived QR on screen is read by the terminal's camera | Works on any phone, no app required | Needs short expiry and single-use rules against screenshot sharing |
| Remote unlock | A button in the app opens the door via the server | An authorised person can open the door from elsewhere (e.g. for a delivery or a waiting guest) | Needs internet; does not prove the person is at the door |
The practical conclusion from comparing the methods is to choose by user group rather than lock into one method. Staff can keep the card as the primary credential, with the phone as a second one. For visitors and contractors, a time-limited QR is usually the lowest-friction route, as we show in our QR code visitor access guide. How plates and driver credentials work together at the vehicle gate is covered in our vehicle access control system guide.
For NFC, the reader's frequency and card type matter too. Phone NFC runs at 13.56 MHz, so older 125 kHz readers will not see the phone at all. The difference is explained in 125 kHz vs 13.56 MHz cards. The cloning weakness of older cards is covered in access card cloning risk.
How to set up mobile access: seven steps to a safe rollout
- Separate your user groups. Decide which credential applies to permanent staff, shift workers, contractors, visitors and managers. Not every phone is company-owned, and using a personal phone should be voluntary and needs a clear privacy notice under KVKK. How this split works where guests and staff share one building is described in hotel staff access control.
- Audit your readers. List each reader's frequency, whether it reads QR codes and whether it supports Bluetooth. The number of readers to replace is often one of the biggest budget lines.
- Define the fallback first. Nobody should be stuck at the door because of a flat battery, a lost phone or an app that will not start. A card, a PIN or a temporary QR issued by security should be a written fallback.
- Test offline behaviour. Know which methods keep working when the network drops; this is why rule sets should be held on the terminal. See access control offline mode for the detail.
- Make sharing hard. QR codes should be short-lived and single-use, and the same credential should not be able to enter twice in a row. That rule is called anti-passback.
- Extend account security to the door. The phone app is an extension of the corporate account; a weak screen lock or password means a weak door. We cover the basics in business password security.
- Start with a small pilot. Run a two- to three-week trial on one door with one team, and measure read speed, failed entries and user complaints before rolling out further.
If you are building the phone app yourselves, there is also a platform decision: separate Android and iOS apps, or one shared codebase? We compare the options in native vs cross-platform apps.
What does mobile access control cost?
The cost of mobile access control depends less on a single licence fee than on how ready your existing infrastructure is for phones. A firm budget only emerges after discovery; these are the main cost drivers:
| Cost item | What it depends on |
|---|---|
| Reader replacement | 125 kHz readers cannot read phones; QR needs a camera-equipped reader and Bluetooth needs a BLE module |
| Chosen method | Time-limited QR needs no app; using the phone as an NFC card or Bluetooth needs both reader support and a mobile app |
| Mobile app | Whether a bespoke app is built separately for Android and iOS or from one shared codebase |
| Points and people | The number of doors, turnstiles and barriers, and which user groups will enter by phone |
| Integration and KVKK preparation | Links to HR, visitor and identity systems; privacy notices and retention rules |
How does Digital Bridge deliver mobile access projects?
At Digital Bridge we treat mobile access as part of the access system rather than an app install. Because software and hardware are built by the same team, you have one point of contact from reader to dashboard.
- Discovery and requirements. We walk every door, turnstile and barrier, record which credentials the existing readers support and map your user groups. If your current card access control hardware can be kept, we say so in writing; the technical feasibility assessment for hardware is free of charge.
- Choosing the method. Together we settle which credential each group uses, the fallback route and offline behaviour, then prepare a written proposal covering scope, phases and cost.
- Where an app is needed. If you need a bespoke mobile credential or remote-unlock app, our mobile app development team designs it around the access system's permission rules.
- Pilot and integration. We pilot on a single door, then connect HR, visitor and identity systems through system integrations. For retention periods and privacy notices we support you through data protection compliance consultancy.
SmartPass: cards and phones under the same rules
SmartPass, developed by Digital Bridge as part of the Smart360 product family, is software that combines card access control, staff time and attendance (PDKS), visitor management and canteen management in one panel. SmartPass works with 13.56 MHz MIFARE and NFC-readable cards; only the card's ID number (UID) is read and nothing is written to the card.
On the phone side SmartPass takes a different approach: an NFC-enabled Android phone (Android 9 or later, NFC-A capable) becomes a mobile terminal, an entry point that reads cards. Decisions are made by the same engine and the same permission rules as at fixed doors. Typical uses are construction site entrances without a fixed door or power supply, roll-call when boarding staff shuttles, temporary event points, and a backup point when a fixed device fails.
Because it carries a copy of the server-signed permission list, the SmartPass mobile terminal keeps deciding without internet; reads are queued on the phone, transferred once the connection returns, and the number of pending passes is shown on screen. The app is installed as an enterprise APK rather than from an app store; the phone joins the organisation through a Smart360 sign-in, a terminal code and administrator approval; the phone's identity rests on its own key in secure storage, and a lost phone can be revoked from the panel. A person's permissions are the union of their access groups, and a rule changed in the panel applies at every fixed and mobile point at once.
SmartPass does not store card numbers: at the moment of reading, the device turns them into a one-way hash with an organisation-specific key, and only the hash and last four digits are kept. Once the retention period ends, fields that identify the person are deleted automatically, and every change is logged with its previous and new value. The same card read that opens the door also creates the attendance record, so no separate time clock is needed. For the criteria to use when picking attendance software, see choosing time and attendance software.
In SmartPass the phone is a terminal that reads cards; presenting the phone itself like a card, or Bluetooth entry, is not among SmartPass's defined features. If your organisation requires either, we assess that as a separate item during discovery and share a written feasibility view.
Next step
Before you get in touch, note three things: the number of doors and readers, your user groups, and the rough Android/iPhone split among your staff. Then reach us through our contact page and we will check together whether your existing readers can work with phones. To buy SmartPass, fill in the SmartPass sales form; product details are at SmartPass.com.tr. For more guides on card access, attendance and visitor management, visit our Access Control & Attendance hub.