QR codes are everywhere. They sit on whisky bottles, supplement jars, luxury handbags, and electronic components. Brands print them on packaging and tell consumers “scan this to verify your product is genuine”.
There is just one problem. A standard QR code takes about thirty seconds to copy.
The copy problem nobody talks about
A QR code is a visual representation of a URL or data string. Anyone with a smartphone can scan it, read the data, and generate an identical code. Print that copy onto a sticker, apply it to a counterfeit product, and the consumer scanning it will see exactly the same verification page as someone scanning the original.
This is not a theoretical risk. The global smart packaging market is valued at $26.8 billion in 2025, growing at 6.9% annually. Authentication is one of its fastest growing segments, precisely because brands are discovering that the QR codes they already use provide no real protection.
Authentication tests increased 40 to 50 percent year on year according to Entrupy data, and counterfeiters have kept pace with every generation of digital labelling with standard QR codes are among the easiest targets.
How counterfeiters exploit QR codes
The attack is straightforward:
- Direct copy: Photograph or scan the QR code from a genuine product. Reproduce it at scale. Every fake product now links to the brand’s own verification page, passing the “scan test” consumers rely on.
- Redirect hijack: Generate a new QR code pointing to a cloned version of the brand’s verification page. The consumer sees a convincing “product verified” message that was never issued by the brand.
- Bulk harvesting: Buy one genuine product, extract its QR code data, and print thousands of copies. The brand’s system may show the product as verified every time, because the code itself is valid.
None of these require technical sophistication. They require a printer.
What “secure” actually means
If a QR code can be copied, it acts more as decoration than authentication. Genuine product authentication requires three things that standard QR codes do not provide:
1. Physical tamper evidence
The label must be impossible to remove and reapply without visible damage. This is the first line of defence: if a counterfeiter cannot transfer the label from a genuine product to a fake, the copy attack fails at the physical layer.
2. Unique, non-reproducible identifiers
Each label must contain an identifier that cannot be generated outside the brand’s own system. A static QR code fails this test because anyone can create an identical one. Secure systems use unique codes tied to individual product units, validated against a central database that tracks every scan.
3. Multi-factor verification
A single verification method, whether QR, NFC, or hologram, can be individually defeated. Combining multiple layers makes counterfeiting economically unviable. When a consumer must verify a holographic element, scan a unique QR code, and check an alphanumeric identifier that all cross-reference each other, the cost and complexity of faking that product exceeds the counterfeiter’s margin.
The dual-interlocking approach
H010’s authentication labels use two interlocking QR codes embedded inside a holographic security layer. This is structurally different from a standard QR sticker:
- The hologram provides physical tamper evidence. Remove it, and it is visibly destroyed.
- Two QR codes, not one, must be scanned and validated together. Copying one is useless without the other, and copying off a hologram is impossible.
- A unique alphanumeric identifier provides a third verification factor.
- Every scan is logged, so the brand sees exactly when and where their products are being verified, and whether the same code appears in locations that suggest duplication.
This is the first time QR codes have been secured at consumer level. Any smartphone can verify the product, no app required, but the label itself resists the copying, redirecting, and harvesting attacks that defeat standard QR codes.
The EU is about to make this mandatory
The EU Digital Product Passport regulation, entering its first implementation phase in 2026, will require brands selling into European markets to attach digital identifiers to their products. QR codes are the most likely carrier format.
This means millions of products will carry QR codes by regulatory mandate. If those codes are standard, static, and copyable, the regulation will have created an infrastructure for counterfeiters to exploit.
Brands implementing DPP compliance should build authentication into their digital identifier strategy from the start, rather than retrofitting security after counterfeits appear.
What to look for in an authentication label
If you are evaluating authentication solutions for your products, these are the minimum requirements:
- Tamper-evident material: The label should be physically impossible to transfer or reproduce without specialised equipment.
- Unique per-unit codes: Every individual product must have its own identifier, validated against a secure database.
- Consumer-accessible verification: If your customers cannot verify the product themselves, authentication only protects your supply chain, not your brand reputation at point of sale.
- Scan analytics: You should see where and when products are being scanned. Unusual patterns (same code scanned in multiple countries, or thousands of scans on a code assigned to a single unit) are early warnings of counterfeiting activity.
- No app required: Any friction in the verification process reduces consumer adoption. If someone needs to download an app to check whether their whisky is real, most will not bother.
The bottom line
Standard QR codes give brands and consumers a false sense of security. They are easy to print, easy to copy, and easy to exploit. If your anti-counterfeiting strategy relies on a QR code that anyone with a phone can duplicate, it is not a strategy. It is a label.
Genuine authentication requires physical security, unique identifiers, and multi-factor verification. That is what stops counterfeits, not the presence of a square barcode on the box.
H010 makes secure holographic labels with dual-interlocking QR codes for product authentication. Consumers verify products with any smartphone camera, no app required. Learn more at h010.com