An RFID tag includes a transceiver for communicating with a tag reader; memory for storing a deactivation string, an encrypted deactivation string created externally to the tag by encrypting the deactivation string, and a trial string created externally to the tag by decrypting the encrypted deactivation; and logic for comparing the deactivation string and the trial string to determine whether they are the same, and, if they are the same, configuring the tag to permit deactivation. A method executed by the RFID tag includes comparing the trial string with the deactivation string to determine whether they are the same, and if they are the same, configuring the tag to permit deactivation. The trial string may be created externally to the tag by decrypting, using a first key, an encrypted deactivation string that is created externally to the tag by encrypting the deactivation string using a second key.