Norwegian Cruise Line ships have door access controllers with an improper authentication vulnerability. These controllers are susceptible to replayed unique identifiers from RFID devices, allowing unauthorized entry. The affected card readers authenticate NFC credentials solely by verifying their static 7-byte UID. This UID is not secret and lacks cryptographic challenge-response capabilities, making it an unreliable authentication factor. Although keycards have memory blocks with serial numbers and signature-like values, the reader ignores this data. Relying only on the UID means the system is identifying rather than authenticating. Since there's no cryptographic exchange, any device capable of replaying or emulating UIDs can create a working duplicate. An attacker can capture a valid keycard's UID with brief physical proximity and an RFID reader. This UID can then be copied to a writable card, creating a counterfeit credential. These fakes will be accepted as genuine by the access control readers, granting unauthorized access. In some cases, these unauthorized entries may not be distinguishable from legitimate use. This poses a significant security risk to both ship operations and guest safety, especially concerning access to restricted areas. Currently, there is no vendor-provided solution, but users can employ RFID-blocking wallets or shielded sleeves to mitigate cloning risks. Wrapping cards in aluminum foil can also create a basic Faraday shield to limit signal transmission. Keeping cards at least 12 inches away from others can help prevent unwanted scans.