A security guard observes an individual entering the building after scanning a badge. The facility has a strict badge-in and badge-out requirement with a turnstile. The security guard then audits…

Badge cloning creates an exact duplicate of the RFID or smart card credential that functions identically to the original. Two successful log entries from the same badge ID in a short window, combined with only one observed physical entry, is the classic indicator that a cloned copy was swiped at a different time or access point by an unauthorized person.

A server malfunction would more likely produce missing entries, duplicate phantom records, or system errors, not two distinct and plausible swipe events tied to a real observed entry.

The crossover error rate (CER) is a biometric system metric where the false acceptance rate equals the false rejection rate and has no relevance to badge swipe log counts.

A lost badge can only produce log entries when physically swiped, so losing it does not explain two entries while the legitimate employee was also observed entering the building.