What should you do after tapping an unknown tag?
In most cases nothing at all, because tapping a tag opens something and stops there. The question that matters is what happened next: whether you entered anything, installed anything, or approved a prompt. Those are the actions worth reviewing, and the tap itself almost never is.
The tap by itself
A tap read a few hundred bytes and, at most, opened a page. Nothing was installed, nothing was granted, and nothing persists on the phone from the tag itself.
The tag did not learn anything about you, has no record of the read, and cannot contact you afterwards. That is covered in detail in this section.
So if you tapped something and then closed it, there is nothing to do and nothing to check.
What to review
Whether you entered anything: a password, an email address, a card number, a code from a message.
Whether you installed anything, or approved a request to install, which on both platforms requires deliberate steps.
Whether you approved a permission prompt, signed in to something, or authorised a payment.
If all four answers are no, the episode is closed. This is the case the overwhelming majority of the time and it is worth saying plainly.
If you did enter something
Change that password immediately, on the real site reached the way you normally reach it, and anywhere else you reused it.
If it was card details, contact the issuer through a route you already know rather than a number from the page, and follow the guidance on fraudulent payments.
If you installed something, remove it, and review what permissions it was granted before you do.
If you approved a sign in prompt for an account, sign out of all sessions on that account and change the password, in that order.
Reporting the tag
If the tag was stuck to somebody's property, tell them. A hostile tag on a parking meter or a shop window is their problem and they usually do not know.
Photograph where it was before removing anything, since the location is the useful evidence and the tag itself carries very little.
Do not try to rewrite or destroy somebody else's tag on your own initiative, which turns a report into a dispute.
And read the tag if you can, so you can tell them what it pointed at. That is the one piece of information that makes a report actionable.
Frequently asked questions
I tapped an unknown tag. Is my phone compromised?
Almost certainly not. A tap opens something and stops. Nothing is installed and nothing is granted by the tap itself.
What should I actually check?
Whether you entered anything, installed anything, or approved a prompt afterwards. If not, the episode is closed.
I entered a password. What now?
Change it immediately on the real site, reached the way you normally reach it, and anywhere you reused it.
Should I report the tag?
Tell whoever owns the surface it was stuck to. Photograph the location, and read the tag if you can, so the report is actionable.