Key facts
- A QR code on its own does not prove a product is genuine: a counterfeiter can photograph a real code and print it on a fake, and the copy opens the same genuine page.
- A QR code becomes an authentication tool when every item carries its own serial number in the code, the code points to the brand's own domain, and the brand watches how each serial is scanned. One serial scanned in many places at once is a copy.
- Shoppers can check a product in under a minute: look at the domain the code opens, then check that the page shows details matching the pack in their hand.
- On Digital Link Connexum, the platform behind this site, each item can get its own serialised GS1 Digital Link, created in bulk, with scan analytics per item on your own domain.
Authenticating a product with a QR code means giving each item a unique, verifiable identity that only the brand can issue and check. The code carries the product's GTIN plus a serial number for that single item, written as a GS1 Digital Link. When someone scans it, the brand's resolver recognises that exact item, shows its details, and records the scan. That record is what exposes copies, because a genuine serial should be scanned in one place, by one owner, a handful of times.
Authentication methods compared
A QR code is the cheapest layer, and the only one most shoppers will actually use. For high-risk products, brands add others:
| Method | What it stops | Shopper effort | Relative cost |
|---|---|---|---|
| Serialised QR code on the brand's own domain | Bulk copying, which shows up in the scan pattern of each serial | Scan with the phone camera | Low |
| Plus a hidden or scratch-off second code | Reusing a code taken from a genuine pack | Reveal, then scan | Low to medium |
| Copy-detection pattern printed in the code | Photocopied or reprinted codes | Scan with a dedicated app | Medium |
| NFC tag with a cryptographic chip | Cloning, because the chip can't be copied | Tap the phone on the product | Higher |
| Holograms, special inks, tamper-evident seals | Casual copying and refilling | Look at the pack | Varies |
The layers combine. A serialised QR code gives every other feature a place to report to, because it tells the brand where and when each item is checked.
How brands authenticate products with a QR code: six steps
- Decide how much protection the product needs. Match the method to the risk: a serialised code is enough for most consumer goods, while luxury goods, spare parts and medicines usually add a hidden code, a copy-detection pattern or an NFC chip.
- Give every item its own serial number. Add a serial number to the GTIN in the GS1 Digital Link, so each unit has its own address, for example
/01/09506000134352/21/A7K29Q. Use serial numbers that can't be guessed, and generate them in bulk or at the end of the production line. - Put the codes on your own domain. A domain shoppers can recognise, such as
id.yourbrand.com, is the first thing they can check, and it can't be faked without the fake looking different. - Make each scan page item-specific. Show what identifies that exact unit: the product name and photo, the batch, the serial number and, where it helps, the production date or market. A shopper can then compare the page with the pack.
- Watch the scan pattern of each serial. A genuine serial is scanned a few times, in one region. The same serial scanned hundreds of times, or in several countries in the same week, means the code has been copied. When that happens, switch that serial's page to a warning and investigate the source.
- Tell shoppers how to check. Print a short line next to the code, such as "Scan to verify", and explain on the page what a genuine result looks like. A check nobody knows about protects nobody.
How shoppers can check if a product is authentic from its QR code
- Check the code is part of the pack. A sticker placed over another code, or a code on a separate tag that looks added later, is a warning sign. See what quishing is.
- Scan with the phone camera and read the address before opening it. It should be the brand's own domain, or the domain the brand names on its official website, over
https://. - Compare the page with the product in your hand. The product name, photo, batch or serial number shown on the page should match what is printed on the pack.
- Look for the brand's verdict. Many brands state on the page whether the item is genuine, or warn when its code has been scanned unusually often.
- If anything doesn't match, contact the brand directly. Use the contact details on the brand's official website, not on the page the code opened, and report where you bought the product.
A matching page is strong evidence, not absolute proof: a code copied from a genuine item opens a genuine page. That is why the brand-side check on scan patterns matters, and why buying from authorised sellers is still the simplest protection. For the wider picture, read are QR codes on products safe.
Authentication on the Digital Link platform
Digital Link, the platform behind this site, covers the QR code layer:
- One code per item. Variants of a product's link carry a serial number, batch or expiry date, following the GS1 Digital Link standard. See how to create variants.
- At scale. Serialised codes are generated in bulk from a CSV file or through ERP and PIM integrations. See integrations and bulk generation.
- Your own domain. Codes run on your subdomain, so shoppers see your brand in the address.
- Scan data per item. Analytics show scans by variant, location and device, which is where a copied serial shows up.
- Pages you can change. Any item's page can be updated after printing, for example to show a warning on a copied serial.
Create your first serialised GS1 Digital Link QR code
Frequently asked questions
Can a QR code prove a product is authentic?
Not on its own. A plain QR code can be copied onto a fake and still open the genuine page. It becomes an authentication tool when each item has its own serial number in the code, the code runs on the brand's own domain, and the brand monitors how each serial is scanned.
How do I check if a product is authentic from its QR code?
Check that the code is printed on the pack rather than stuck on, read the address before opening it to confirm it is the brand's own domain, and compare the page with the product: name, photo, batch or serial number should match. If anything doesn't match, contact the brand through its official website.
What is a serialised QR code?
A QR code that identifies one single item rather than a product line. In a GS1 Digital Link, the serial number is added after the GTIN, so every unit has its own web address and its own scan history.
How do brands detect copied QR codes?
By watching the scans of each serial number. A genuine item is scanned a few times in one region. A copied code shows up as the same serial scanned many times, often in different places, and the brand can then flag it.
Is NFC better than a QR code for authentication?
NFC tags with cryptographic chips are harder to clone, so they suit high-value products. They also cost more per item and need a tap rather than a camera. Many brands use a serialised QR code for every product and add NFC only where the risk justifies it.
