Secure QR codes for anti-counterfeiting, with examples

Global brands are embracing secure QR codes for use in anti-counterfeiting due to advances in digital printing, smartphone cameras, and recent changes in consumer habits. Taken together, these changes have made secure QR codes more scalable and cost-effective than traditional physical security features like holograms and taggants. Not all QR codes used for anti-counterfeiting are the same though – several different solutions have emerged for securing QR codes, each with different strengths and weaknesses.

In this article, we apply decades of Scantrust experience pioneering anti-counterfeit security to an in-depth review of the security features, pros, and cons of using QR codes to detect and protect against counterfeit products, packaging, and documents.

1. Overview: Types of QR codes used for anti-counterfeiting
2. How counterfeiters typically copy packaging and QR codes
3. Static and dynamic QR code security
4. Serialized (unique) code security
5. Secure QR codes security
6. How to protect against counterfeiters bypassing your QR code
7. How practical it is for users to scan QR codes for product authentication
8. How to choose a QR-code-based anti-counterfeiting solution

Case study: How Rémy Cointreau uses Secure QR codes

This diagram shows a common example of a counterfeiter successfully copying the packaging, including the QR code, of a product:

The same counterfeiting approach shown above is thwarted by a secure QR code which is resistant to being copied. When scanned by an end-user or customer it is possible to instantly detect copied packaging or product labels as counterfeit.

Counterfeiting method: Copy the secure QR code label directly using a high-resolution scanner and printer

“Static” and “dynamic” are technical terms for the kind of URL which is embedded in a QR code. These features of QR codes don’t intrinsically provide security, though they can make it slightly easier to monitor and potentially shut down counterfeits.

Basic example of dynamic QR code vs. static QR code

Dynamic QR codes are more common in enterprise use cases due to the ability to “see” all traffic (QR code scans) going through the redirect URL. Another important Dynamic QR code feature for enterprise is the ability to change the destination URL as needed and on demand. This characteristic provides flexibility in managing and updating a QR code after the code has been printed. With static QR codes, you’re stuck with the destination URL used—unless you make advanced DNS changes later to redirect users. That approach with static QR codes can be fraught with problems though, which is why dynamic QR codes are preferred.

As we’ll show in the following detailed example, both static and dynamic codes don’t intrinsically provide any security against counterfeiting.

​​Static QR codes are the most basic of QR codes and also the least secure. These codes are often made using free QR code generator tools found online or using a spreadsheet application like Excel. They include an embedded URL that cannot be changed once the code is printed.

Here is an example static QR code counterfeiting scenario:

Context: A consumer encounters a static QR code which has been copied and re-printed by a counterfeiter. These codes are not unique and serialized from one product to the next:

1. Prints static QR codes: A motor oil brand prints the same static QR code on millions of genuine motor oil bottles with a link to the product website.
2. Counterfeiter makes copies of the motor oil packaging, including the QR code.
3. A customer buys a counterfeit product and scans the copied QR code
4. Customer sees product webpage: The customer is redirected to the same product information website URL as customers who have bought the real product.
5. Result is no mechanism for checking if the product is genuine: There is no easy way for the motor oil brand to distinguish which users on the product information website came from the “real” product or from the “fake”, and thus, no way to alert customers that they’ve obtained a counterfeit product.

In a scenario where a counterfeiter has copied packaging, a document, etc. with a static QR code, the end-user is usually unable to visually distinguish the counterfeit QR code. When the URLs on the counterfeit and real packages are all the same, all things being equal, it would be difficult for the brand owner to confidently distinguish which QR code scans (and thus, hits to the URL) are coming from real products or fake ones. At the very least, this pollutes what would have otherwise been useful consumer usage data.

Pros: None! Standard QR codes have no anti-counterfeiting capabilities.

Cons: Any counterfeiter can copy these static QR codes for use on counterfeit products.

Dynamic QR codes are codes with an intermediary URL embedded in the QR code. These codes redirect the customer to another URL, usually leading to a web page with product or marketing information.

Here is an example dynamic QR code counterfeiting scenario, assuming the codes are not unique from one product to the next:

1. Print dynamic QR codes: A motor oil brand prints a dynamic QR code on each batch of hundreds of thousands of products for a total of millions of motor oil bottles (NB: oftentimes, one dynamic code is used on all products, not different ones by batch—this practice offers less security and utility).
2. A counterfeiter copies a product and packaging, including the dynamic QR code, from one batch of motor oil.
3. A customer buys a counterfeit product and scans the counterfeit dynamic QR code.
4. Customer sees product webpage: The counterfeit dynamic QR code redirects the customer to the intended product information website URL, just as would occur with customers that bought the genuine product.
5. Result is no ability to check if product is genuine: Neither the brand or the consumer have an easy way to distinguish which site visitors came from; the real product or from the counterfeit. Thus there’s no way to know which of the dynamic QR codes (which batch) was counterfeit, finally. There’s no way to notify customers that they’ve purchased a counterfeit product.

Can you spot the fake?

Note that in the above flow, the brand could have used a different static QR code for each batch as well. Taken together, the above two examples illustrate that neither static nor dynamic QR  codes provide significantly different levels of protection.

Pros: The brand may eventually get a  bit more information on which batch was counterfeit, but otherwise has little recourse.

Cons: A counterfeiter is not particularly dissuaded from copying such a dynamic QR code to use and sell counterfeit products.

Serialized QR codes are unique from one product or document to the next. The links embedded in them may be static (point to a URL that can’t be changed once printed) or dynamic (can be changed after the code is printed, through an intermediary, redirect URL).

Here’s an example counterfeiting scenario using dynamic, serialized (unique) QR codes:

1. Print unique, dynamic QR codes: A motor oil brand puts a unique serial number into a dynamic QR code on every bottle.
2. A counterfeiter makes copies of the bottle packaging of one product, including the unique, dynamic QR code.
3. Customers buy counterfeit products and some scan the counterfeit QR code.
4. Customers scan the QR code and try to authenticate the product. The product is only identified as counterfeit if the code is blacklisted by the brand, which usually happens after thousands of counterfeit products have already been bought and scanned in the wild.
5. The brand gathers anti-counterfeiting data including the individual motor oil bottle’s unique QR code which has been scanned hundreds of times, in many different locations.
6. Eventually, the brand identifies a specific QR code which is counterfeit, and using their anti-counterfeiting solution, changes the information displayed to any future scans of this code to, “this is a counterfeit product.” This is called “blacklisting.”
7. The brand gathers geographic information on the scan location, where the product may have been purchased, pictures, and otherwise gather evidence for pursuing legal action against the counterfeiters.

• Pros: The brand was able to eventually discover which product was counterfeit (down to the unit level), as well as where geographically those products were scanned. Once the code was blacklisted, further authentication scans of that code by customers would result in a notification that they had purchased a counterfeit product.
• Cons: Depending on alert thresholds, hundreds or thousands of customers may have purchased the counterfeit product and scanned it before the brand would have discovered and blacklisted the counterfeit product’s QR code.

Serialized QR codes provide data invaluable for anti-counterfeiting efforts

Case study: How Dupont uses Secure QR codes on water filters

The above image shows real-world scan data from a single serialized QR code scanned 234 times by 163 unique scanners. The geographical distribution of the scans gives a good indication that the users scanning the products are distinct. This particular code was flagged as a “suspected counterfeit” well before 234 scans were recorded, but at this point, it’s more or less a certainty that there is a counterfeit problem.

This data can mean the difference between a company having legal options against counterfeiters or having none. What’s most interesting about this real-world example is that the original purpose of serializing QR codes on the brand’s products wasn’t to address a counterfeit problem; they were applied to drive personalized, segmented marketing campaigns; another function for which serialized QR codes are useful. In this case, the brand owner did not at all suspect they had a counterfeit problem!

A copy detection pattern, also known as a copy-resistant image or embedded security image, is a digital image designed to lose key information when copied and re-printed, thus signaling that it is a copy. It’s just like when you use a photocopy machine, the copy never looks as good as the version you printed from your inkjet printer.

Using this principle, it’s possible to insert a randomly-generated security image into a portion of the QR code, making it a “secure” QR code that can be authenticated as the original.

When counterfeiters copy secure QR codes, the result is detectable using a simple mobile phone camera.

Here is an example wherein a customer buys a counterfeit product with a Secure QR code (it has a security image embedded in the QR code):

1. Print or apply secure QR codes. A motor oil brand puts a Secure QR code on every bottle.
2. A counterfeiter copies the bottle packaging of one product, including the Secure QR code.
3. Several customers buy counterfeit motor oil products and scan the counterfeit QR code directly.
4. The customer checks the authenticity by following on-screen instructions in the product authentication web or mobile app.
5. The anti-counterfeiting solution identifies the Secure QR code as a “lossy” fake.
6. The customer is notified of the counterfeit and the brand is alerted.
7. The surrounding QR code is blacklisted so that all future scans of it also result in the customer being informed that it is a counterfeit product.

In the following example, a sophisticated counterfeiter attempts to bypass the secure QR code.

Counterfeiting method: Copy the packaging but replace the QR code with one controlled by the counterfeiter

The counterfeiter is using their own QR code, domain name, and website, and thus control’s the full journey of a customer or user who scans the counterfeit product’s QR code. The domain name is often a slightly-altered spelling of the brand or anti-counterfeiting technology provider’s actual website and easy to mistake for an official authentication website.

Even in this scenario, using serialized QR codes or a secure QR code in a well-designed anti-counterfeiting program enables the brand owner to use crowdsourcing to detect the counterfeit products in-market. This is because a well-designed anti-counterfeiting program will provide two ways to authenticate:

1. Users can authenticate by directly scanning a QR code. This can be circumvented by a counterfeiter who completely replaces your serialized or secure QR code with theirs, and sends the user to their own fake website.
2. Users can authenticate by first visiting a trusted channel for authentication, such as an official web or mobile app or social media account, and then begin the authentication process there.

Let’s flesh these out in more detailed examples:

“Untrusted channel” scenario: User authenticates by directly scanning a QR code made by the counterfeiter (ie, it’s not a copy of a genuine product’s code). This sophisticated counterfeit is not detected:

“Trusted channel” scenario: User first visits a trusted channel (official mobile app or website) then scans the QR code within that web or mobile app. The sophisticated counterfeit is detected.

As a rule of thumb, between 1% and 20% of products with a QR code are scanned by an end-user, varying widely by market, product category, and the incentive or use case for scanning the code. There are use cases where the scan rate can be higher than 20% – for example, warranty registration or to claim a reward. A successful connected packaging solution rollout requires designing a connected packaging approach that will make it easy for your customers to authenticate your products and understand the benefits of doing so.

Generally, there are a few key considerations when deciding what QR code security level to use.

• Desired security robustness or “strength”- As demonstrated above, basic static and dynamic QR codes that are non-serialized (not unique) provide virtually no protection against counterfeits or actionable counterfeiting data from the market. Serialized QR codes provide limited and delayed protection, while secure QR codes with embedded security images provide strong, immediate protection.
• Cost of the solution and total-cost-of-ownership – Serialized and secure QR codes generally have some setup costs associated due to the requirement to integrate with the printing equipment. On top of the setup costs, they’re also usually priced on a per-code basis.
• Ease of implementation – This is dependent on the exact anti-counterfeiting solution chosen, how you print today, the printing equipment you currently use. An experienced secure QR code solution provider will be able to quickly help you navigate your options to find the fastest path to your goals.