# Scanning a tag

Two taps to verify a product, start to finish.


You have a live tag: the one you just wrote, or one from a demo kit, an order,
or a tagged product. Time to verify it the way every customer will. Any
NFC-enabled phone works, yours or a colleague's, and everything happens in the
browser. The phone is the only tool you need.

## Find your phone's NFC reader

- **iPhone (iOS 13+):** the reader is at the very top. Hold the top edge over
  the tag.
- **Android:** the antenna is usually centre-back, but varies by model. If
  nothing happens, move the phone slowly across the back of the product.

> If NFC is turned off, enable it in your phone's settings.

> If you are signed in to the dashboard on this phone, a tap on one of your
> own tags opens its
> [edit form](/docs/dashboard/custom-data#editing-a-tag-by-scanning-it)
> instead of the check below. Press **Continue to Verification Page** there, or
> sign out, to see what your customer sees.

## First tap: start verification

Hold the phone to the tag until a browser page opens. You'll see a prompt to tap
again. This first tap starts the check, and it does not confirm authenticity
yet.

[Image: After the first tap, the product page asks you to tap the tag again. See the web version of this page.]

## Second tap: confirm

Tap the same tag again within a few minutes. This completes the check: TAGBASE
confirms the tag is genuine, live hardware.

## Read the result

- **Authentic:** the tag is genuine and the product is real.
- **Not authentic:** the second tap repeated the proof from the first. Copied
  and tampered tags fail here.

On a genuine tag, the product page opens with the product's photos and details,
and the result reads **Authentic**:

[Image: The verification page on a phone: product photo, tabs, and the green authentic-product result. See the web version of this page.]

## What just happened

Each tap makes the tag build fresh proof of itself, and it never builds the same
proof twice. The proof from your two taps is what TAGBASE compares.

### The first tap opens a pending verification

The page the tag opens carries proof that a genuine tag produced it. TAGBASE
checks that proof, finds the tag in your account, and records the tap as
`pending`. The page shows no verdict yet, because one proof on its own says
little. Anybody who taps a real product can capture the proof that came out of
it.

### The second tap has to bring new proof

Within a few minutes, the same tag has to produce a second proof, newer than the
first one. That is the part a copy cannot do. New proof moves the verification
to `valid` and the page turns green. The same proof a second time ends the
session as `invalid`.

The window is short on purpose, ten minutes by default. Somebody can capture the
proof from a genuine product and pass it around, and it runs out of time long
before it helps anybody sell a fake.

### Where a copy fails

A copied tag is a recording. Somebody taps a genuine product, captures the proof
it produced, and writes that one proof onto a cheap tag or prints it as a QR
code. The copy gets past the first tap, because that proof was real at the
moment somebody captured it. It fails the second tap, because a recording plays
back what it already holds.

A printed code carries the same weakness, however long or unique you make it.
Print holds one value for good, so whoever photographs it holds that value too.
Hardware that answers differently on every tap is what proves the product is in
your customer's hand.

### Where the check runs

All of it runs on TAGBASE servers. The phone opens an ordinary web page, and
neither the page nor the browser holds a key. A tampered phone can change what
your customer sees on screen. The verdict in your dashboard comes from our
servers either way.

### When a scan does not turn green

- **Not authentic.** The second tap replayed the proof from the first. Treat
  the item as suspect and check the entry in your
  [verifications](/docs/dashboard/verifications) list for the place and time.
- **The page asks for a first tap again.** More than ten minutes passed between
  the taps, so the pending verification timed out. Tap twice in a row and the
  check completes normally.
- **Nothing opens at all.** NFC is off, or the phone's reader is not over the
  tag. The tap never reaches TAGBASE, so nothing shows up in the dashboard.

The [security model](/docs/overview/security) covers the full threat model,
including the tamper seal and the signals we collect on every tap.

That's the whole loop, and TAGBASE recorded it: every scan of your tags shows
up in the dashboard, live.

Next: [using the dashboard](/docs/getting-started/using-the-dashboard).