Let R and T be a legitimate reader and a tag, respectively.
Assume that the OTP protocol transfers the tag T from the
old owner to the new owner. After running the OTP protocol
successfully, the old owner still knows ID of the tag because
ID is constant and unique for each tag. We show that using
only this ID value, the old owner can identify that any session
between R and T belongs to T . The attack can be described
as follows.