What Happens After an NFC Tag Is Scanned?

Before the mechanics, the context. Three pressures are converging on product-bearing brands:

• Counterfeiting at scale. The global trade in counterfeit goods reached USD 467 billion in 2021, up to 2.3% of world trade (OECD/EUIPO, Mapping Global Trade in Fakes 2025). Clothing, footwear and leather goods alone account for 62% of seized counterfeits.
• Grey market leakage. Products sold into one territory surface in another. Without per-item identity, brands cannot trace the diversion path.
• Regulatory obligation. The EU Digital Product Passport registry went live on 20 July 2026 under ESPR (Regulation (EU) 2024/1781). The same tap that authenticates a product can surface the compliance data regulators require.

Each of these demands a per-item digital identity. NFC authentication delivers it. But the value is only clear when you see what happens inside the scan.

NFC product authentication assigns each physical item a unique digital identity stored on a secure NFC chip embedded in or attached to the product. When a consumer taps the product with a smartphone, the chip proves its identity cryptographically. The result, genuine or suspect, appears on the phone screen without any app download.

The chip family that makes this possible is the NTAG 424 DNA, built on ISO/IEC 14443-A (NFC Forum Type 4). It carries an AES-128 secret key that never leaves the silicon. Every tap produces a fresh, one-time authentication code. Copying the chip’s surface data is useless because the next tap requires a new code that only the original chip can generate.

A basic NFC tag is like a house key you can photograph. A secure NFC tag generates a new lock every time someone approaches the door, and the only way to produce the matching key is to be the original chip.

The full sequence, from physical contact to on-screen result, unfolds in eight stages. Total elapsed time: 1.5 to 2.5 seconds on a standard mobile connection.

Step	What happens	Elapsed time
1. Physical coupling	The phone’s NFC reader generates a 13.56 MHz radio field. When the tag enters range (1 to 5 cm), the chip harvests power inductively. No battery in the chip.	~0 ms
2. Chip computation	The chip increments its internal tap counter and computes an AES-CMAC authentication code over its UID, the counter value, and session data. The secret key never leaves the chip.	~10 ms
3. NDEF delivery	The chip transmits an NDEF message, a URL, to the phone. In the SUN/SDM model, the UID, counter, and authentication code are mirrored into specific positions within the URL string.	~50 ms
4. Phone opens the URL	iOS triggers an App Clip or Safari. Android launches the default browser or a registered app. No download required on either platform.	~100 ms
5. Request reaches the platform	The URL arrives at the brand’s cloud platform. The platform extracts the UID, tap counter, and authentication code from the URL parameters and looks up the corresponding product record.	~200 ms
6. Server-side verification	The platform independently computes the expected authentication code using the same algorithm, the stored key, and the expected counter value. Both the code and the counter must match.	~50 ms server-side
7. Result delivery	The phone displays the verdict: genuine or suspect. Alongside it, the brand can surface provenance, ownership registration, DPP data, care instructions, or engagement content.	~1.5-2.5 s total
8. Event logged	In parallel, the platform logs the scan: chip UID, counter, timestamp, IP-derived location, device type, authentication result. The consumer sees none of this.	Asynchronous

The critical distinction: the authentication code is not static data printed on the chip. It is computed fresh on every tap using a secret key that exists only inside the silicon and a counter that increments irreversibly. Replaying a previous code fails because the counter has moved forward.

A scan that returns “Authentic” proves three things simultaneously:

1. The chip contains the correct secret key. Only chips provisioned during manufacturing carry it.
2. The tap counter is in the expected range. The counter has not been duplicated or rolled back.
3. The chip UID is registered in the product database. The chip was commissioned for this specific item.

A chip that scans but fails authentication is a stronger signal of intentional counterfeiting than a chip that does not respond at all. A non-responsive chip may indicate physical damage or incorrect placement. A readable chip returning the wrong authentication code indicates a copy attempt, a chip sourced outside the deployment, or parameter tampering.

Every scan produces a data record. Some fields are logged automatically. Others require the consumer’s consent.

Data point	Logged automatically	Requires consent
Chip UID	Yes
Tap counter value	Yes
UTC timestamp (ms precision)	Yes
IP-derived location (country/city)	Yes
Authentication result + failure mode	Yes
Device type (OS, browser)	Yes
GPS location (precise)		Yes
Owner identity (account data)		Yes
Engagement data (content viewed, dwell time, actions)		Yes

This is first-party product data, collected at the point of use, without any advertising platform intermediary. Over time, the scan log builds into an interaction history for every individual item.

The scan log supports four distinct operational functions. Each one improves as the dataset grows.

Grey market detection

Scan geography is compared against territory allocation. A product shipped to the Middle East generating scans in Paris is a diversion signal. Because each chip is linked to a specific shipment, the brand can trace the leak to a consignment and a date. The diversion path becomes visible at the item level.

Counterfeit mapping

Authentication failures cluster geographically when a counterfeiting operation is active. A spike in failed scans in a single city, concentrated on a specific product line, is an enforcement signal, not a statistical curiosity.

Consumer engagement

Scan data reveals when and where consumers interact with products, what content they view, and whether they register ownership. This data informs marketing, loyalty programmes, and product development decisions. The consumer who taps twice a week for six months is visible. Without digitisation, she is invisible.

The compounding dataset

A product that passes through multiple owners, multiple scan events, and multiple countries accumulates a rich interaction history. That history is useful for secondary-market trust, warranty validation, and regulatory compliance. The dataset becomes more valuable the longer the deployment runs.

Both NFC and QR can carry a unique identifier per item. The security properties diverge at the authentication layer.

Capability	Secure NFC (NTAG 424 DNA)	Serialised QR code
Unique per-item identity	Yes	Yes
Cryptographic authentication	Yes, AES-128 challenge-response per tap	No, static data
Clone resistance	High: secret key never leaves the chip, one-time code per scan	Low: any camera copies the code
Tap counter (replay protection)	Yes, hardware counter increments irreversibly	No hardware equivalent
App required	No (iOS background read from iPhone XS/XR; Android native screen-on)	No (camera)
Marginal unit cost	Published converter prices for NTAG 424 DNA-class labels cluster around $0.45-0.65/unit at five-figure volumes, on-metal +7-30% (public catalogues, 2026)	Printed QR adds near-zero marginal print cost; the real cost is serialisation + platform (industry sources, 2026)
DPP carrier suitability	Trust layer (cryptographic proof), not the default visible carrier	GS1 Digital Link QR is emerging as the de facto default visible carrier for DPP

When QR is the right choice

For very high-volume, low-unit-value products with no secondary market and no counterfeiting pressure, serialised QR codes deliver traceability at a fraction of the per-item cost. A $3 cleaning product does not warrant a $0.50 NFC tag. A $300 bottle of single malt does. The decision turns on what is at stake per item: if the answer is brand equity, consumer trust, or regulatory exposure, cryptographic authentication earns its cost back.

For DPP compliance specifically, the architecture that is emerging pairs a GS1 Digital Link QR as the visible, scannable carrier with NFC as the trust layer underneath. Compliance through the QR. Proof through the chip.

The scan sequence is identical across categories. What changes is what appears on screen after the verdict and what the scan data is used for.

Wine and spirits. The chip sits inside a tamper-evident closure. A broken seal changes the chip’s response, proving the bottle has been opened. Scan data tracks bottles through distribution and flags territory diversions. Post-tap content can include tasting notes, vineyard provenance, cocktail recipes.

Luxury goods and fashion. Tags embedded in leather goods, watches, or garments serve as digital certificates of authenticity that travel with the item through resale. Ownership transfer via the platform creates a verified chain of custody. Scan read reliability across deployments reaches 99%.

Cosmetics and fragrance. Authentication protects against health-risk counterfeits. Post-tap content can surface ingredient lists, usage guidance, and batch-specific DPP data as ESPR delegated acts roll out.

Cigars. Tags integrated into bands or box seals authenticate individual sticks or boxes. The premium price point justifies per-item authentication, and the collector market benefits from verifiable provenance.

Furniture and premium audio. Standard NFC tags detune on metal surfaces. On-metal tags with a ferrite layer solve this. The tag becomes the product’s digital identity for warranty, registration, and service history.

The central EU DPP registry has been live since 20 July 2026 under ESPR (Regulation (EU) 2024/1781). Delegated acts for textiles and apparel are indicatively expected around 2027, with enforcement following 18 months or more after adoption. Batteries already have their own passport from 18 February 2027.

The same NFC tap that authenticates a product can surface the data the DPP requires: material composition, recyclability, carbon footprint, care and disposal instructions. Brands that digitise products for commercial reasons, authentication, consumer engagement, grey-market control, get regulatory compliance as a by-product. Brands that build only for compliance miss the commercial return.

The carrier architecture emerging in practice: GS1 Digital Link QR (with GTIN + serial) as the visible, regulation-facing carrier. NFC as the cryptographic trust layer beneath it. One tap, two functions.