The Access Control Gaps I Find at Most Properties

Ghost credentials, copyable hardware, and undocumented system access aren't edge cases. They're the baseline at most properties I walk into — and all three are problematic, leave you exposed, and create liability issues you won't see coming.

What access control gaps show up most consistently across multifamily portfolios? After years of working with owners and asset managers across the Atlanta market, the answer is consistent. Ghost credentials that have been accumulating with no natural stopping point unless someone is actively looking. Physical credentials that can be copied without anyone knowing — and recycled in a way that keeps those copies active indefinitely. And system access tied to former employees or shared logins that nobody has cleaned up. They don't surface until something goes wrong, and when they do, they make an already bad situation worse.

1. Ghost Credentials — The Liability That Builds Quietly

Ghost credentials are active fobs, cards, or PINs that remain enabled in the system after the person they were issued to has left — a former resident, an ex-employee, a vendor whose contract expired months ago. On legacy systems that require manual deactivation with no connection to leasing data, they accumulate during every lease cycle.

The financial exposure is straightforward: if an incident occurs and the investigation reveals that multiple former residents or employees still had active access at the time, the audit trail — which is supposed to be the access control system's primary value in a liability situation — works against you instead of for you.

Modern platforms address this at the source. Swiftlane, LiftMaster, and Accentra Multifamily integrate directly with property management software. When a lease expires, the credential is automatically deactivated. No manual step, no lag time, no ghost credentials accumulating between audits. For owners managing multiple properties, that automation removes a consistent liability exposure without requiring ongoing management attention at each site.

2. Credential Technology — The Security Gap Baked in at Construction

This is a gap most owners don't know exists — and it's a direct result of how access control systems get specified during construction.

Most multifamily access control systems are installed with 125kHz credential technology. The reason is straightforward: it's cost-effective, and during construction when budgets are being managed tightly, it's the default. The tradeoff is that 125kHz credentials — standard proximity cards and fobs — can be copied using inexpensive equipment available at retail locations.

The more significant issue is what happens with recycled credentials. Most communities collect and reissue fobs and cards when a resident moves out. What most owners don't realize is that if a credential was copied before it was returned, deactivating it and reissuing it to the next resident doesn't deactivate the copy. The duplicate stays active. Both credentials work. The system can't tell them apart.

When an incident occurs — vandalism, unauthorized amenity access, a situation that prompts pulling the access log — the audit trail points to whoever the credential was assigned to at the time. If a copy of that credential was used, the documentation is pointing at the wrong person. That's not a minor administrative problem. In a liability claim or legal proceeding, it's a significant one.

The more secure alternative is 13.56MHz technology. Higher frequency credentials use encrypted communication that is significantly harder to replicate. For owners evaluating their portfolio's access control posture, this is worth understanding. If your properties were built or renovated with standard proximity credentials, you may have a hardware-level vulnerability that no amount of process improvement fully closes.

3. Undocumented System Access — What It Looks Like Across a Portfolio

When I get called in to assess a property before a transaction or following an incident, one of the first things I look at is who currently has access to the access control platform and the other security systems on site. At most properties, I find one of three situations.

Nobody has a current login — credentials were set up during the original installation and nobody knows who has them or whether they still work. Or everyone on staff has been using the same shared login, which means there's no reliable audit trail — every access event in the system looks identical regardless of who actually performed it. Or a former manager or employee still has active platform access that was never removed after they left.

One note specific to DoorKing: if properties in your portfolio are managed through the DoorKing cloud portal, it's worth taking a close look at how admin users are set up and who currently has access. That's where we see shared credentials most often — and where former employees are most likely to still have active access without anyone having checked.

From a portfolio management perspective, any of these creates exposure. In a liability claim, an access control system with shared credentials or active logins for former employees undermines the documentation you're relying on. In a due diligence review, undocumented system access signals an operational gap. In an insurance context, a system where nobody can produce a clear picture of who has access to what is harder to represent as a managed security asset.

The fix is individual credentials for every user, a clean removal process when someone leaves, and a service provider who handles that transition reliably. Gotcha Security does this as part of our standard process — the incoming manager gets their own access, the outgoing manager's credentials are removed, and the audit trail stays intact through every transition.

One More Thing Worth Knowing — Upgrades Don't Mean Starting Over

Two upgrade conversations come up regularly and both are simpler than most owners expect.

If credential security is a concern and you want to move from 125kHz to 13.56MHz, that's a reader swap — not a full system replacement. The controllers, wiring, and door hardware already in place stay exactly where they are.

If the access control system itself needs to be replaced — new platform, PMS integration, modern credential management — that's also not a gut job. In most cases it's the controllers that are replaced, not the readers, wiring, or door hardware. The infrastructure you already have goes further than most people assume.

Both conversations are worth having before writing off an upgrade as too disruptive or too expensive.

Gotcha Security works with owners and asset managers across the Atlanta multifamily market on access control assessments, platform upgrades, and system access management. If you'd like to know where your portfolio stands, we're glad to take a look.

Download: Multifamily Security & Life Safety Inspection Checklist 

Download: Gotcha Security Property System Record — a fillable document capturing every security and life safety system across your portfolio, including platform names, access credentials, inspection history, and monitoring account details. Fill it out yourself or contact us and we will complete it for you.

Gotcha Security provides:

• Security Cameras & Video Surveillance
• Access Control Systems (Swiftlane, LiftMaster, Accentra Multifamily) & Vehicle Gates
• Burglar Alarm Systems & Monitoring
• Fire Alarm Monitoring
• Full Life Safety Inspections — fire sprinklers, extinguishers, emergency lighting, hydrants, backflow preventers & BDA/ERCES

Frequently Asked Questions

Why do ghost credentials create liability exposure for multifamily owners?

If an incident occurs and the investigation shows former residents, employees, or vendors still had active access at the time, the access control audit trail works against you instead of for you. Modern platforms like Swiftlane, LiftMaster, and Accentra Multifamily integrate with property management software to automatically deactivate credentials at lease expiration, removing this exposure at the source.

What is the credential recycling problem in multifamily access control?

Most communities collect and reissue fobs and cards when a resident moves out. If a credential was copied before it was returned, deactivating and reissuing it to the next resident doesn't deactivate the copy. The duplicate stays active — and any access it triggers shows up in the audit trail under the new resident's name, not the person who actually used it. In a liability claim or legal proceeding, that documentation is pointing at the wrong person.

How does undocumented system access affect multifamily due diligence and liability?

Buyers and their counsel increasingly review access control documentation during due diligence. A system with shared credentials, active logins for former employees, or no clear picture of who has access signals an operational gap. In a liability claim, that same documentation problem undermines the audit trail you're relying on as a defense.

Does upgrading access control mean replacing the entire system?

Not necessarily — and usually not. Upgrading from 125kHz to 13.56MHz encrypted credentials is a reader swap — the controllers, wiring, and door hardware stay in place. Replacing the access control system itself — new platform, PMS integration, modern credential management — typically means replacing the controllers, not the readers, wiring, or door hardware. In most cases the existing infrastructure goes further than people expect.

What should multifamily owners look for in an access control platform?

PMS integration for automatic credential deactivation at lease expiration, support for 13.56MHz encrypted credentials, individual user logins that maintain a clean audit trail, and a service provider who handles credential setup and removal through staff transitions. Swiftlane, LiftMaster, and Accentra Multifamily are the platforms Gotcha Security installs and supports across the Atlanta market.

Interested in an access control assessment for your portfolio? Call us at 678-430-3116 or visit gotchasecurity.net.

Gotcha Security | Atlanta, GA | Serving the Multifamily Market