Only very old systems, or those where the cost of the tag has to be as low as possible (e.g. for single-ride throwaway paper tickets), use unauthenticated bearer tokens.

Access control systems these days usually do not, for obvious reasons.