How Brands Use NFC Tags, From Payments to Product Passports

Near field communication, or NFC, is the technology behind tapping a phone or card on a payment terminal. Brands increasingly put the same technology into products and packaging, using small tags that a shopper can tap with a smartphone. Here is how it works, where it is used and where it falls short.

How NFC works

According to the NFC Forum, the industry body that maintains the standards, NFC is a radio technology operating at 13.56 MHz. It has a typical range of up to about 2 centimetres and data rates from 46 kbit/s up to around 1.7 Mbit/s.

A key feature is that the reading device can also supply power over the connection. This means tags embedded in clothing, bottles or boxes need no battery. They usually hold a small amount of data, often a web address.

The Forum defines several operating modes. The most common is card emulation, in which a phone or watch behaves like a contactless bank card or transit ticket. In reader/writer mode, a phone reads or writes tags, which is the mode most brand applications rely on. NFC can also exchange data between two devices and deliver up to 1 watt of wireless charging to small gadgets. Tag data usually follows the Forum's NFC Data Exchange Format (NDEF), so any compatible phone can interpret it.

Documented uses

Payments. Contactless card payments are the most widespread use of NFC. The European Central Bank reported 29.6 billion contactless card payments in the euro area in the first half of 2025, up 12.8% on a year earlier and worth about €0.8 trillion. The same report found that 93% of the region's roughly 24.7 million point-of-sale terminals accepted contactless transactions. Phone access has also widened: in August 2024, Apple said that from iOS 18.1 developers could offer NFC transactions in their own apps, separate from Apple Pay, in uses such as loyalty cards, event tickets and hotel keys.

Authentication. Luxury and fashion groups use NFC tags or QR codes to give each item a digital identity. Vogue Business reported in June 2024 that the Aura Blockchain Consortium, whose founding members include LVMH, Prada Group and Cartier, said it had recorded at least 40 million luxury goods. The technology behind it has supported projects including OTB Group's NFC chips and Loro Piana's QR codes. On the standards side, the NFC Forum's Signature Record Type Definition lets readers check that tag data is genuine and has not been altered.

Digital product passports. The EU's Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, introduces a digital product passport. The European Commission describes it as a "digital container" for information on a product's materials, origin, repairability and recycling. A data carrier, such as a QR code, links each physical item to its passport. Under the Commission's indicative timeline, passports become mandatory for certain batteries, including those used in electric vehicles, on February 18, 2027. Rules for iron and steel, textiles, tyres, aluminium, furniture and other groups are expected to follow through 2029. The NFC Forum has published an NFC Digital Product Passport specification so that tags can act as these data carriers. NFCW reported that one selling point is the ability to store some passport data on the tag itself, so it can be read offline.

Smart packaging. Many applications are simpler: a tag on a label or box opens a web page with instructions, ingredients, warranty registration or recycling guidance. Because the tag usually stores only a link, the content can be updated after the product ships.

Limits: security and privacy

NFC's short range reduces the risk of casual eavesdropping, but it is not a guarantee of security. A basic tag that stores only a web address can be read by anyone. A counterfeiter could also copy it, or a fraudster could stick a different tag over it. That is why authentication schemes rely on cryptographic signatures or chips that generate verifiable codes, not on the presence of a tag alone.

Phones are a target too. In August 2024, ESET researchers described NGate, Android malware that relayed NFC data from victims' payment cards, through their compromised phones, to criminals withdrawing cash at ATMs. Victims had installed the malicious app from outside the official Google Play store after receiving deceptive messages.

Privacy is the other trade-off. A tap usually opens a page on the brand's website, so the interaction can be logged like any other web visit. In the EU, that data falls under the same data protection rules as other online tracking.

NFC is mature and standardised, and EU passport rules are pushing it into everyday products. Its value depends on the security and information behind the tap.