NFC authentication

How does NFC authentication work?

A standard NFC tag stores a web address and a factory-written serial number (UID). Both can be read by anyone with a phone, and a counterfeiter can copy the address to a new tag or use special hardware that imitates the UID. A plain tag therefore proves nothing about authenticity.

Secure NFC chips add cryptography. A widely used example is NXP’s NTAG 424 DNA. It holds secret AES-128 keys that never leave the chip. On every tap it generates a new authentication code, called a Secure Unique NFC (SUN) message, and writes it into the URL the phone opens, together with an encrypted tap counter. The server that receives the URL knows the key, recalculates the code and checks the counter. If the code is wrong, the tag is not genuine. If the counter has not increased, someone is replaying a copied URL.

Because the check runs through a normal web address, no app is needed. Android phones open the URL directly, and iPhones from the XS onward read NFC tags in the background. The person tapping sees a page that confirms the product and can then show anything else: product information, registration, warranty or reorder.

• Plain tag: static URL and UID, easy to copy, fine for engagement, not for proof.
• Symmetric secure tag (for example NTAG 424 DNA): a new AES-based code on every tap, verified by the server.
• Tamper-evident tag (for example NTAG 424 DNA TagTamper): adds a conductive loop around the seal or cap; the chip reports whether the loop is intact or broken.
• Public-key chips: newer chip types sign with asymmetric keys, so verification does not depend on one shared secret.

Where is NFC authentication used?

NFC authentication is used where a fake causes real damage or where the original carries a premium. Typical fields are luxury goods and fashion, wine and spirits, cosmetics, medical devices and pharmaceuticals, spare parts, collectibles and limited editions, event tickets and high-value certificates or documents.

In each case the same tap does two jobs. It tells the customer, retailer or inspector that the item is genuine, and it opens a digital channel the brand controls. That makes NFC authentication a natural part of connected packaging and a possible data carrier for a Digital Product Passport, where the EU rules leave the choice of technology open.

What are the limits of NFC authentication?

The chip proves that the chip is genuine, not that the product around it is. If a secure tag can be peeled off an original and moved to a fake, the check passes for the fake. That is why the integration matters as much as the chip: tags embedded in the material, bonded so that removal destroys the antenna, or combined with a tamper loop across the opening.

There are further practical limits. Secure chips cost more than standard marketing tags. The system depends on a verification server and on careful key management, usually with a separate derived key per tag. Metal and some foils block the signal unless the tag is designed for them. And a check only helps if people actually tap, so packaging needs a clear call to action and staff or customers need to know what a genuine result looks like.

How does NFC authentication compare to other anti-counterfeiting methods?

Holograms and special inks are visual features: cheap, recognisable, but checked by eye and imitated over time. Serialised Data Matrix codes, as used on EU medicine packs since 2019 together with an anti-tampering device, are checked against a central database; the code itself can be copied, so the system relies on each serial being verified and decommissioned once. Secure QR codes with copy-detection patterns detect a reprint by the loss of fine print detail when scanned. Digital watermarks hide the code in the image.

Secure NFC differs in one key point: the proof is generated inside the chip on every read and cannot be calculated without the key. The trade-offs are unit cost and the need for a tap. Many brands layer methods, for example a printed code for universal access plus a secure chip for the high-value check. More on the two consumer carriers in QR code vs. NFC.

How do you measure NFC authentication?

Each verification is an event on the server: valid, invalid, replayed or tampered. Counting these over time shows how often products are checked, where suspicious results cluster and whether a batch is being copied. City-level location and timestamps can reveal products appearing in markets they were not shipped to. The same data shows engagement, such as which content people open after the check and how many register or reorder. Anything that identifies a person falls under data protection rules and needs a legal basis.

How does Interactive Paper approach NFC authentication?

Interactive Paper embeds NFC chips between layers of paper and board instead of sticking them on, so a chip cannot be peeled off and moved without destroying the piece. Each piece can carry its own identifier, and every tap runs through the Let’s interact platform, which logs timestamp, device type and city-level location. The same construction works with secure chip types where authenticity matters.

On the print side, this is the technology behind Tap and Tap Premium, used for premium mailings, invitations and certificates that should feel valuable and be hard to imitate. For product labels and packaging, Interactive Paper runs its NFC label brand NFC XR.

Frequently asked questions