QR codes for verification, and what they cannot prove
Can a QR code verify that something is genuine?
A QR code cannot verify anything on its own. It is a printed pattern, and anyone holding one genuine item can photograph the code and reprint it as many times as they like. What does the verifying is the record the code points at, and specifically what that record knows about how often this exact code has already been scanned.
That distinction sounds pedantic and is the whole subject. Most systems sold as QR authentication are really databases with a scanner attached, and understanding which half is doing the work tells you where the weaknesses are.
Unique per item, or it proves nothing
The first decision is the one that cannot be undone later. If every unit of a product carries an identical code, that code can tell a customer what the product is, and nothing else. It cannot tell you that the same item has been "verified" in four countries this week, because it cannot tell those four scans apart.
A unique payload per unit changes what is knowable. Now a duplicate shows up as one identifier scanned repeatedly, frequently in places the item never shipped to, and that pattern is the actual counterfeit signal. Generating those means producing a distinct code per label rather than duplicating one image, which is a bulk job driven from your own list of identifiers.
The code is not a secret, and cannot be
It is printed on the outside of the product. Every customer can read it, photograph it, and post it. Any design that treats knowledge of the code as proof of possession is already broken.
So make it unguessable rather than secret. A sequential identifier is the common mistake: if unit 1041 exists then 1042 probably does too, and an attacker who buys one genuine item can print a run of neighbouring codes that all check out. Random, long, and sparse in the space of possible codes is what stops enumeration.
This is also why the verification page should never leak more than it must. A page that displays the customer name, the order, or the shipping destination behind an unauthenticated code has turned a photograph of a box into a disclosure.
First scan, and what it is worth
The strongest signal a code-based system has is scan history. The first scan of a code is ordinary. The fortieth, from six countries, is not.
Be careful about how that is presented. "This code has been scanned before" is not proof of a counterfeit: customers rescan things, shops scan stock, and a returned item is scanned again by the next buyer. Treat repeat scans as a signal to investigate rather than a verdict to show a shopper, or you will be telling honest customers their genuine purchase is fake.
It also means the timestamps matter more than the total, and that the counting has to be honest about link previews. A code shared in a chat gets fetched by the messaging app to build a preview, and counting those as scans inflates exactly the number a fraud rule would trigger on. We classify and exclude those fetches for that reason.
What the code cannot do, and what covers it
A code answers which item is this. It cannot answer has this been opened, and it cannot answer is the thing inside the box the thing the label describes.
Those are physical questions and they need physical answers: tamper-evident seals, a label that destroys itself on removal, a code printed under a scratch panel so that a first scan necessarily means the package was opened. Pair the code with one of those and each covers the other's gap. Deploy the code alone and you have built a very precise way of confirming that a counterfeiter owns a working printer.
If the code is going on packaging that also needs a retail barcode, the identifiers and their formats are covered in QR codes on packaging and GS1 Digital Link, which is the standard built for exactly this overlap.
Questions
The things people ask before they commit something to paper.
Can a QR code prove a product is genuine?
Not by itself. A QR code is a printed pattern, and anyone holding one genuine item can photograph its code and reprint it a thousand times. What proves anything is the record the code points at, and what that record says about how many times this exact code has already been seen.
How does QR code verification actually work?
Each item gets a unique, hard-to-guess payload. Scanning opens a page that looks the code up on the server and reports what it knows: whether the code was ever issued, what it was issued against, and whether it has been scanned before. The answer comes from your system. The code is only the pointer that reaches it.
Why does every item need a different code?
Because a single code repeated across a production run cannot distinguish one unit from another, so it cannot tell you that the same code has appeared in two places at once. That duplicate-detection signal is the entire value. One code copied onto a whole run is a label, not a check.
Should the verification code be a secret?
Treat it as unguessable, not as secret. It is printed on the outside of a product, so anyone holding the item can read it and it will end up photographed. Make it long and random enough that it cannot be enumerated, and design the system so that knowing a code is not the same as proving possession.
What stops someone copying a verification code?
Nothing stops the copy. What you can do is make copying visible. Unique codes plus first-scan tracking mean a duplicated code shows up as the same identifier scanned repeatedly, often in places the item was never shipped to. Combine it with a physical tamper-evident feature, because the code answers "which item is this" and the label answers "has this been opened".