Modern Visitor Access: Choosing Between Intercoms, PINs, Mobile Credentials, and QR Codes

Visitor access is no longer a choice between a doorbell and a shared keypad code. Commercial offices, apartments, schools, warehouses, and managed facilities can combine video intercoms, PINs, mobile credentials, and temporary QR codes. The challenge is deciding which method fits the visitor journey, the site's risk, and the people who will administer it.

The best answer is often a controlled mix. Expected visitors can receive a time-limited credential, unexpected visitors can call an authorised person, and staff can use a separate managed credential. The design should make entry easy without creating permanent shared codes, unreviewed remote unlocking, or a visitor log that collects more information than the organisation needs.

Start with the visitor journey

Map what happens from invitation to departure. A useful visitor access brief answers these questions:

• Who invites the visitor and who is allowed to approve entry?
• Is the visit expected, recurring, or unplanned?
• Does the visitor need one door, several doors, a lift, or a parking gate?
• What time window should the permission cover?
• Does the visitor need an escort?
• What happens if the app, mobile network, cloud service, or receiving person is unavailable?
• How is the credential cancelled, and how long is the visit record retained?

A loading dock with regular contractors has a different workflow from a reception door, a residential apartment entrance, or an after-hours plant room. Choose the credential after the workflow is understood.

Intercoms provide human verification

An intercom is the strongest option when an authorised person needs to speak with or see an unexpected visitor before releasing the door. It works well at public entrances, apartment buildings, reception points, delivery doors, and sites where the reason for entry matters.

The main design question is not whether the intercom has a camera. It is who receives the call and what happens when that person does not answer. Call routing, escalation, after-hours behaviour, network resilience, audio intelligibility, camera view, lighting, and remote release security all affect the result.

The Akuvox R20K doorphone is one example of a compact entrance device. A keypad-equipped door station can support visitor calling while also giving authorised users a credential option. Confirm the exact credential functions, network method, mounting accessories, and current firmware requirements for the project.

Intercom approval adds judgement, but it also adds workload. If reception answers every routine contractor call, the system may become a bottleneck. Pre-authorised visitor credentials can remove routine calls while leaving the intercom as a fallback.

PINs are simple but need strict lifecycle control

A PIN is familiar and does not require a smartphone, physical card, or printed pass. It can suit short visits, service contractors, cleaners, or temporary staff when the platform allows a unique code with a defined schedule.

The risk is sharing. A permanent code can move far beyond the intended user, and there may be no reliable way to know who entered it. Good practice is to avoid communal visitor PINs and instead issue unique credentials with:

• a start and expiry time
• permission for only the required door or area
• a clear owner or visit reference
• automatic expiry
• the ability to revoke immediately
• event logging appropriate to the site's policy

Do not make codes predictable from apartment numbers, phone numbers, dates, or company names. Where the device supports several credential types, keep staff access separate from visitor access so that revoking a visitor does not disturb normal operations.

The Akuvox A08K keypad access terminal is an example for projects that require PIN and card capability. Product selection should still begin with the platform workflow, not the keypad alone.

Mobile credentials suit managed users

A mobile credential can be practical for employees, residents, and recurring contractors because permissions can be tied to an individual account and changed centrally. It can reduce card administration and support remote onboarding.

It is less ideal when a visitor does not want to install an app, has a flat battery, has no data connection, uses an unsupported device, or needs only one brief visit. The design therefore needs a fallback such as an intercom call, staffed reception, temporary PIN, or QR code.

Before specifying mobile access, confirm:

• supported phone platforms and enrolment process
• whether unlocking uses Bluetooth, NFC, a cloud command, or another method
• what works when the internet connection is unavailable
• how a lost or replaced phone is removed
• whether device sharing or account sharing can occur
• how administrators audit and revoke credentials

Keep user training simple. People should know which door to approach, whether the phone must be unlocked, what permission is required, and what to do when entry fails.

QR codes are strong for expected visitors

A QR credential is useful when the host knows who is coming and the visitor should not need an app. The visitor can receive the code before arrival and present it at the reader. Akuvox's current SmartPlus documentation confirms that temporary visitor keys can use QR codes and can be limited by selected doors, validity periods, repeat mode, and permitted uses.

That control is valuable, but a QR code is still shareable. A screenshot or forwarded message may allow another person to present the same credential unless the system and process add further verification. Reduce the risk with short validity windows, one-time or limited-use rules where supported, identity checks for higher-risk visits, and immediate revocation when plans change.

The Akuvox R29C-L smart doorphone is an entrance option for projects that need an integrated visitor experience. Confirm the exact credential set and software licence for the current device and platform release before specifying.

Compare the four methods

Method	Best fit	Main weakness	Useful fallback
Intercom	Unexpected visitors and entries that need human approval	Depends on an available, trained recipient	Reception procedure or authorised call escalation
Temporary PIN	Short visits where a keypad is available	Easy to share or observe	Intercom and rapid revocation
Mobile credential	Staff, residents, and recurring approved users	Phone, app, enrolment, and connectivity dependencies	Card, PIN, or intercom
Temporary QR code	Expected visitors who should not install an app	Can be copied or forwarded	Intercom or reception verification

No method removes the need for a policy. Technology can enforce time and door permissions, but the organisation must decide who can invite, approve, view logs, revoke access, and investigate exceptions.

A practical mixed-mode design

For many sites, a layered workflow is more resilient than one universal credential:

1. Employees and residents use managed mobile or card credentials.
2. Expected visitors receive a time-limited QR code or unique PIN for the minimum required doors.
3. Unexpected visitors use the intercom.
4. High-risk visitors receive human verification and an escort.
5. Every temporary permission expires automatically.
6. A local fallback procedure covers network, cloud, or mobile failure.

This keeps the entrance usable without turning the fallback into a permanent bypass. A mechanical key, shared service code, or permanently unlocked period should not quietly become the real operating model.

Plan the platform, network, and door hardware together

The credential is only one layer. A complete visitor access design includes the door station or reader, controller, lock, request-to-exit device, door position monitoring, power supply, network, management platform, and receiving endpoint.

Confirm where access decisions are made and what continues locally during an outage. Document firewall and VLAN requirements, time synchronisation, account roles, backup power, certificate management where applicable, firmware maintenance, and who owns the cloud or software account after handover.

The lock and egress arrangement must remain suitable for the door and occupancy. Visitor convenience does not override life safety, accessibility, or building requirements. Coordinate with the relevant designers and authorities where required.

Protect visitor information

Visitor names, phone numbers, images, entry events, vehicle registrations, and host details may be personal information. New Zealand's Office of the Privacy Commissioner states that the Privacy Act 2020 principles govern how organisations collect, store, use, and share personal information. The principles include purpose, security, accuracy, retention, use, and disclosure.

Apply data minimisation. Collect only what the visitor process needs, explain the purpose where required, limit administrator access, set an appropriate retention period, and securely remove records when they are no longer required. If information is collected indirectly, review the current requirements including IPP 3A, which came into force on 1 May 2026.

Biometric functions require particular care because the consequences of misuse can be significant. Do not enable every available feature by default. Complete the privacy and security assessment first, then configure only the functions the site has approved.

Commission the complete visitor workflow

• Test invitations, delivery, enrolment, use, expiry, and revocation.
• Test the wrong door, early arrival, late arrival, and repeated scans.
• Confirm intercom call routing during business hours and after hours.
• Verify remote release permissions and event records.
• Test phone and network failure paths.
• Check accessibility, reader position, display prompts, audio, and lighting.
• Confirm door monitoring and alarms after access is granted.
• Give administrators a written process for issuing and cancelling access.

Include at least one test by a person who was not involved in the installation. A workflow that seems obvious to the integrator may be confusing to a first-time visitor.

Frequently asked questions

Which method is best for a one-time visitor?

A time-limited QR code or unique PIN is often convenient when the visit is expected. Use an intercom or reception check when identity or visit purpose needs human verification.

Are QR codes more secure than PINs?

Not inherently. Both can be shared. Security comes from unique issuance, narrow door permissions, short validity, limited uses where supported, logging, and a process that revokes credentials quickly.

Should every visitor install an app?

Usually not. Apps are better suited to recurring users. A QR code, temporary PIN, or intercom avoids unnecessary enrolment for a one-time visit.

What happens if the internet fails?

That depends on where credentials are stored and decisions are made. Confirm the platform's offline behaviour, local controller capability, and fallback process before handover. Test the failure mode rather than relying on assumptions.

How long should visitor records be retained?

Keep them only as long as the documented purpose requires, subject to applicable legal and operational needs. Set a retention rule instead of leaving records indefinitely.

Choose the workflow before the credential

Modern visitor access works best when the credential follows the visit. Use intercoms for human verification, temporary PINs or QR codes for expected short-term access, and mobile credentials for recurring managed users. Then connect those methods to clear permissions, automatic expiry, resilient door control, and responsible information handling.

Browse the Akuvox intercom door stations collection, or contact Essential Security Supplies to review the visitor journey, doors, network, and management requirements for your project.

Technical sources checked

• Akuvox Smart Access manufacturer page
• Akuvox current product and platform knowledge base
• New Zealand Office of the Privacy Commissioner privacy principles