Choosing a product identifier that resists copying: NFC, QR, RFID and unclonable features

Start with how a fake or diverted item would get past the check, because each identifier fails in a different way.

Copying is the simplest attack: photograph a code, print it on a thousand fakes, and every one scans as genuine. Transplanting moves a real identifier from a genuine item, or its packaging, on to a counterfeit. Refilling keeps the original container and replaces the contents, the main exposure for spirits, perfume and lubricants. Diversion sells genuine goods outside the channel or market they were released for, so provenance rather than authenticity is in question.

Name who scans, too. A customs officer with a dedicated reader, a warehouse gate and a customer in a bar have different tools and motivation, and the identifier must serve the person whose decision it informs.

A static QR code printed identically on every unit is cheap and readable by any phone camera, but a photocopy works exactly as well as the original. Serialising the code adds a little: the record shows where each serial has been scanned, and one serial scanned in two countries on the same afternoon is worth investigating. That is a signal, not proof, because the first scan of a copied serial looks legitimate.

Copy-detection patterns are printed areas of fine, high-entropy detail that lose information when scanned and reprinted, so a verifier can judge whether it is looking at a first-generation print. They keep the low cost and phone reach of printing, but results depend on print control at the factory, the camera and lighting during the scan, and a verification service that stays available for the product's life.

Whichever printed option you choose, a GS1 Digital Link URI is a sensible way to encode the identifier: it writes the product's GS1 key, plus a serial or batch where needed, as a web address that one QR code can carry for retail and consumer use alike². It identifies; it does not authenticate.

A basic NFC tag stores a fixed identifier and a link. Phones read it without an app, but its contents can be copied to a blank tag with consumer tools, so it is no stronger than a serialised QR code.

Cryptographic tags change that. NXP's NTAG 424 DNA, for example, uses AES-128 cryptography and offers what NXP calls SUN message authentication within a standard NDEF read, so an ordinary phone tap returns a link carrying a fresh, verifiable code¹. The verification service checks that code with an incrementing tap counter, so a link captured from one tap and replayed later fails. A TagTamper variant adds a loop that reports whether a seal has been opened¹.

What cryptography cannot stop is a transplant: a genuine tag peeled from a real product and stuck on a fake still produces valid messages. The defence is mechanical as much as digital. Embed the tag inside the product or closure, use inlays that tear on removal, and bind the tag to a serialised visual feature that the verifier also checks.

UHF RFID, promoted under the RAIN name, lets fixed and handheld readers identify many items at once from a few centimetres to several metres away³. That suits stock counts, dock-door receiving and spotting diverted cartons, and the reads can feed the same provenance record as a consumer-facing tag.

It is a weak channel for consumer checks. Most phones cannot read UHF tags, and the read range that helps a warehouse becomes a tracking risk once a garment leaves the shop. If a tag identifier can be linked to a customer, through a loyalty account or a registered warranty for instance, its reads may become personal data under the GDPR⁴. Detach or disable tags at the point of sale and keep consumer checks on a short-range channel.

Physical unclonable features rely on randomness that manufacturing cannot reproduce on purpose, such as leather grain, paper fibres, laser-mark speckle or variation in a chip's silicon. Enrolment captures the feature once and later checks compare against it. They are very hard to copy, but often need a dedicated scanner, and wear can change them over the years.

Tamper evidence is the partner every option needs against refilling and transplanting. Seals that break visibly, closures that destroy the inlay when opened and tags that report a loop's state turn a silent swap into something a person can see.