Method for upgrading an existing access control system, said existing access control system comprising at least one access point which is controlled by a reader unit for reading authorization information from a portable token and a corresponding unlocking device, wherein the reader unit is in wired connection via at least one 1st control line communicatively connected to an access controller, wherein said access controller is in wired connection via at least one 2nd control line communicatively connected to said unlocking device, and wherein said access controller controls the locking state of said unlocking device via said 2nd control line by verifying identification information transmitted via 1st control line from said reader unit, wherein the upgrading method comprises the steps of interposing into the at least one 1st control line an interception unit, said interception unit adapted to and allowing for receiving and, if needed after temporarily withholding said identification information from said reader unit, only transmitting it to the access control unit once said interception unit has verified permission to access independently via a 2nd communication with a holder of said token, wherein to do so the interception unit comprises at least one radiofrequency interface with which it establishes a wireless communication channel between said interception unit and a mobile handheld device of said holder, wherein said verification by the interception unit involves retrieving information about access permission of said holder via said mobile handheld device, wherein the radiofrequency interface is a wireless local area network (WLAN) interface, a Bluetooth interface, Bluetooth smart, including a low-energy Bluetooth interface, and wherein retrieving information about access permission of said holder via said mobile handheld device includes the step of establishing an external wireless communication using a WLAN or telecommunication channel by said mobile handheld device to an overall control authority which verifies access permission independently and transmits, if access granted, a corresponding permission back to said mobile handheld device and directly and/or in directly via said radiofrequency interface to the interception unit. interposing into the at least one 1st control line an interception unit, said interception unit adapted to and allowing for receiving and, if needed after temporarily withholding said identification information from said reader unit, only transmitting it to the access control unit once said interception unit has verified permission to access independently via a 2nd communication with a holder of said token, wherein to do so the interception unit comprises at least one radiofrequency interface with which it establishes a wireless communication channel between said interception unit and a mobile handheld device of said holder, wherein said verification by the interception unit involves retrieving information about access permission of said holder via said mobile handheld device, wherein the radiofrequency interface is a wireless local area network (WLAN) interface, a Bluetooth interface, Bluetooth smart, including a low-energy Bluetooth interface, and wherein retrieving information about access permission of said holder via said mobile handheld device includes the step of establishing an external wireless communication using a WLAN or telecommunication channel by said mobile handheld device to an overall control authority which verifies access permission independently and transmits, if access granted, a corresponding permission back to said mobile handheld device and directly and/or in directly via said radiofrequency interface to the interception unit.