How to Spot a Counterfeit NTAG Chip Before You Buy 100

Introduction

Order a small sample, then check three things before you buy in bulk: memory size, UID and the originality signature. A tag that taps and writes fine can still be a fake, so a simple read test tells you very little. This is about protecting you as the buyer; if you are still choosing a tag type, start with our buying NFC tags guide.

GoToTags notes that counterfeit NFC chips are sold on the market, often pretending to be supported chip types. Here's how to catch them.

Check the basics first

Start with what the datasheet promises. NXP lists 144, 504 and 888 bytes of user memory for NTAG213, NTAG215 and NTAG216, with a manufacturer-programmed 7-byte UID on each device. If you need a refresher on which one fits, see NTAG213, NTAG215 and NTAG216 compared.

Memory size and UID

Run a few quick checks on every sample tag:

• Read the tag with an app that shows chip details. Does the reported type match what you ordered?
• Compare the usable memory against the figures above. A listing that says NTAG215 but behaves like a smaller chip is a red flag.
• Look at the UID. A genuine NTAG has a 7-byte UID, so a 4-byte one doesn't match the datasheet.

These checks catch lazy fakes. A careful one slips through, and that's where the signature check earns its keep.

Order a sample batch

Buy 5 to 10 tags from the supplier first, not 100. Test all of them, and keep the listing and the order record so you can raise a dispute if they fail.

Read the originality signature

NXP chips can carry a signature that proves who made the chip. GoToTags explains that it uses Elliptic Curve Cryptography: the manufacturer keeps a private key secret, and at manufacturing that key and the chip's UID produce a signature written to the chip. NTAG210, 212, 213, 215, 216, 224 and 424 all support it.

Verifying it takes three steps:

1. Read the signature with a chip-specific command. Tools limited to NDEF data can't read it.
2. Get the manufacturer's public key and algorithm for that chip.
3. Verify the signature against the UID.

The GoToTags page gives a 64-character hex string as its NTAG213 example, which is 32 bytes. The GoToTags Desktop App can validate signatures on chips that support the feature, so you don't have to build the check yourself.

An invalid signature means the chip is likely counterfeit. Test every sample tag, and if one fails while the others pass, ask the supplier about that batch before you order more.

What a valid signature proves (and doesn't)

A valid signature is strong evidence, not proof. GoToTags says it is currently impossible for anyone outside NXP to manufacture a chip with a new and valid signature. But it also warns that some highly configurable chips support UID and signature manipulation, which would let someone make an exact copy of an existing valid NXP tag that this check can't detect.

Two more limits to keep in mind:

• The signature verifies the chip manufacturer only. It doesn't prove the origin of the item the tag is attached to. If you are weighing authenticity for branded products, read authenticating products with NFC.
• Seritag describes the manufacturer check as a static signature tied to the UID: harder to clone, but not widely accepted as a complete answer. Tags that generate a fresh code on every scan resist copying better.

Without a valid signature, GoToTags adds, you can't trust the UID or features such as locking either.

Before you place the order

Keep it short:

• Order a sample batch and test every tag.
• Confirm chip type, memory size and 7-byte UID.
• Read and verify the originality signature.
• Ask the supplier about return terms before paying for the full run.

If the sample passes, the bulk order is a much safer bet. If it doesn't, you've lost a small sample fee, not the whole run.

Frequently Asked Questions

Can a fake NTAG chip still work with my phone?

Often yes. A counterfeit can store and serve NDEF data, so a basic read or write test proves little. The differences show up in memory size, the UID and the originality signature.

Does a valid originality signature guarantee the tag is genuine?

It is strong evidence, not proof. Per GoToTags, highly configurable chips that allow UID and signature manipulation could copy a valid NXP tag in a way the check cannot detect.

Do I need NXP's public key?

Yes. Verification needs the manufacturer's public key and algorithm for that chip. Tools such as the GoToTags Desktop App can validate the signature for supported chips.