We show a tracking attack against the newest ID-transfer scheme for low-cost RFID tags. In this attack, a wide attacker, i.e. an attacker that can access the verification result of a server, is able to forge a set of specific messages, and to track a tag. The attack is unique as it involves three sessions of the protocol. Finally, a simple feasibility analysis of the attack is given.
