How do brands authenticate products with NFC?
A chip that proves it holds a key, a service that verifies the proof, and a way for a customer to reach that service. The unavoidable weakness is that the chip attests to itself: it proves the tag is genuine, and says nothing about the object it is attached to.
The three parts
A chip that authenticates, applied to or embedded in the item during manufacture.
A service holding the corresponding key material and a record of which tags were issued, able to judge a proof and say yes or no.
A route for the customer: a tap that reaches the service, through a page or an application, and returns an answer they can understand.
Each part is available and none is exotic. Assembling all three, and keeping them running for the life of the product, is the work.
The gap in the middle
The chip proves the chip. Nothing in the exchange concerns the handbag, the bottle or the spare part.
So a counterfeiter with access to genuine tags has a working fake, and the cryptography was never involved. Sources of genuine tags include returns, damaged stock, factory overruns and the packaging people discard.
This is not a theoretical weakness. It is where attention goes once the chip itself is out of reach, and any programme that has not considered it has considered only the easy half.
Closing it as far as it closes
Bind the tag to the item so that removing it destroys it, which is what a tamper construction does and what it is genuinely good for.
Record which identifier belongs to which item, so that a valid tag in the wrong place is detectable rather than invisible.
Watch the pattern rather than the single check: the same tag verified in two countries in one day is a signal no chip feature would have produced.
Control the tags as inventory. Unissued stock, returns and rejects are the supply, and a programme that does not account for them is leaking.
What to claim honestly
That the tag is genuine and was issued by you. That much is provable and worth saying.
Not that the product is genuine, which the tag cannot establish, and claiming it invites the exact attack that works.
Tell the customer what a positive result means and what it does not, because a customer who believes a green tick certifies the object is a customer who will be defrauded confidently.
And decide in advance what happens on a negative result, since the answer shapes whether the whole thing is a control or a decoration.
Frequently asked questions
Does authentication prove the product is real?
No. It proves the tag is. A genuine tag applied to a counterfeit defeats the scheme with no cryptography broken.
Where do counterfeiters get genuine tags?
Returns, damaged stock, overruns and discarded packaging. Controlling tags as inventory matters as much as the chip.
What closes the gap?
A tamper construction that destroys the tag on removal, a record of which tag belongs to which item, and watching patterns rather than single checks.
What should the customer be told?
That the tag is genuine and issued by you. Claiming the product is certified invites the attack that actually works.