The UID
Every tag's factory serial number. Handy for telling cards apart, useless as a secret — and plenty of systems treat it as one anyway.
The UID (Unique Identifier) is a serial number burned into a chip at the factory. When a reader wakes a card, the UID is the first thing it hears — on HF it's how anticollision tells two cards apart when they're both in the field. It's 4, 7 or 10 bytes on ISO 14443, and LF tags carry their own equivalent.
Think of it as the number printed on the outside of a padlock. It names the lock. It doesn't open it.
#It's not a secret
The UID is sent in the clear, before any authentication, every single tap. Anything with an antenna can read it. That's fine — it's meant to be public, the same way your phone's Bluetooth name is public. The trouble starts when a system decides the UID is the credential.
Plenty do. A cheap "RFID" door or time clock reads the UID, checks it against a list, and opens. No challenge, no key, nothing the card has to prove. That's identification standing in for authentication, and it's the original sin of cheap access control.
#Random UIDs
Because a fixed serial is also a tracking handle, privacy-minded cards don't
use one. E-passports, payment cards and phones in
card-emulation mode present a random UID that changes on every tap (on
ISO 14443-A it starts with 08, the "this is random" flag). The reader still
gets a UID for anticollision; it just can't use it to recognise you later.
#So what should a system use?
The UID is great for what it's for: anticollision, and telling your cards apart in your database once they've actually authenticated. It should never be the thing that proves a card is genuine. For that you need a card that holds a secret and proves it without handing it over — which is the whole point of public-key cards, and the dividing line in why old cards are a bad idea.