An identity reader device includes a short-range transceiver for outputting an advertisement signal to a smart device, and for receiving an ephemeral ID from the smart device, wherein the ephemeral ID is not permanently associated with a user of the smart device, a network interface for providing the first ephemeral ID to a remote authentication service, and for receiving responsive data from the remote authentication service, a visual display for display one or more graphical user interfaces, and a processor for directing the visual display to display a first GUI to the user, in response to the responsive data, for determining whether the user is authorized, and for directing output of a physical action, in response to determining that the user is authorized.