How to Check if a Product Is Original by QR Code, and When You Need NFC

You scan the QR code on a box. A page loads with the brand's logo and says "Genuine product". Is the item in your hand authentic?

Not necessarily. The page only proves that someone printed that code. Here's what a QR code can tell you, what it can't, and what to check instead.

What a QR code scan actually checks

A QR code is a picture of some data. Usually it's a web address with a serial number at the end.

Your phone camera reads the picture and opens the address. A server then looks up the number.

That lookup can be useful. It can show product details, a batch, a production date or a warranty page. But it can't connect the result to the physical object.

The code doesn't change between scans. And a code that can be photographed can be printed again.

So when a counterfeiter copies an authentic label, the copy points to the same page. It gets the same "Genuine" answer. The code is authentic. The product may not be.

That gap is the core problem with QR code product authentication. We cover it in more depth in why QR codes can't prove authenticity.

How to check an original product by QR code: what you can still do

If the item only has a QR code, you can still lower your risk. None of these steps proves the product is authentic. But each one can expose a careless fake.

Check where the code takes you. Look at the address in your browser before you trust the page. It should be on the brand's own domain, or on a verification service the brand names on its website. Watch for look-alike spellings, extra words, or URL shorteners that hide the destination.

Compare against the brand's official channel. Go to the brand's website yourself, without using the code. Find out how the brand says products should be verified. If it doesn't mention QR verification at all, a "verification" page on the box means very little.

Look at the serial number. If the page shows a serial, compare it with the one on the product, the receipt or the warranty card. A mismatch is a clear warning sign.

Pay attention to scan history, if it's shown. Some systems display how often a code has been scanned. A high count on an item sold as new is suspicious. A low count doesn't clear it, though. A counterfeiter can copy a code before anyone has scanned it.

Treat the result as information, not proof. A QR page tells you what the brand says about a serial number. It doesn't tell you that this particular object carries that serial legitimately.

Why an anti-counterfeit QR code still has limits

Brands have tried to harden QR codes in several ways. There are one-time codes that expire after the first scan, scan counters, hidden patterns in the print, and scratch-off layers on top of the code.

Each of these helps a little. Each also creates its own problem.

A one-time code fails the second honest customer, such as a gift recipient or a reseller's buyer. Scan counters get confused by photos shared online. Special print features need trained eyes or extra equipment, which most buyers don't have.

And the identity still lives in something visible that can be photographed.

That's why we treat QR as a good information layer and a weak trust layer. Our TAGBASE vs QR codes comparison lists the trade-offs side by side.

What changes with NFC and a per-tap signature

The alternative is to move the identity from a printed picture into a small chip. An NFC tag is a tiny chip with an antenna that a phone can read at close range.

Not all NFC tags are equal. A basic tag stores a fixed web address. A fixed address can be copied onto another tag as easily as a QR code can be reprinted. We explain that problem in static NFC tags: just another QR code in disguise.

Secure chips work differently. Take the NXP NTAG DNA chip (424 DNA, 223 DNA or 224 DNA). Each chip holds a secret key. The key is designed to stay inside the chip and can't be read out by a phone.

Each time it's tapped, the chip builds a fresh message that includes a counter. It signs that message with the key and hands it to the phone. The server then checks the signature and the counter.

In practice, that means:

• A copied message fails, because the counter has already moved on.
• A cloned chip fails, because the copy doesn't have the secret key.
• The signature changes with each tap, so there's no static code to photograph or reprint.

The answer is tied to the chip in the product, not to a label someone printed.

A variant, the NTAG 424 DNA TagTamper, can also report whether a seal or closure has been opened. We cover that in beyond authentication with TagTamper.

For the buyer, the steps are simple. Tap the tag with a phone. A page opens in the browser and shows the result. There's no app to install.

Authentication for high-value products: choosing the right level

Not all products need cryptography. A QR code is a perfectly good way to link a cereal box to a recipe page. What matters is what a fake would cost the brand and the buyer.

A rough way to think about it:

• Information and marketing. Recipes, manuals, campaigns, or a digital product passport you only need to read. A QR code is fine.
• Products where fakes mainly hurt reputation. Consider a QR code backed by a serialized database. Be honest with customers that it informs rather than proves.
• High-value or safety-relevant products. Watches, jewelry, luxury goods, spirits, cosmetics, spare parts, medical and pharmaceutical items. This is where a per-tap cryptographic identity earns its place. The person scanning needs proof about the object, not the label.
• Items that change hands. Resale, rental and warranty claims depend on knowing the item is the same one that left the factory. A chip that stays with the product can carry that history from owner to owner.

A practical setup keeps both. A printed QR code stays on the outer packaging for reach. An NFC chip sits in the product itself for proof.

Where TAGBASE fits

TAGBASE is trust infrastructure for physical objects. We give each item a digital identity anchored in an NXP NTAG DNA chip. Our platform checks the signature on each tap.

Buyers see the result on a verification page in their phone's browser, powered by TAGBASE VERIFY. Brands can also run TAGBASE VERIFY white-label, so the check appears on their own website under their own brand.

The same identity can carry more than a yes-or-no check: ownership records for resale, product information, digital product passport data, and insight into where and when products are scanned. You can see how that looks for luxury goods and for watches and jewelry.

The same idea works for places, too. TAGBASE PRESENCE uses clone-resistant NFC tags fixed at a location to give timestamped proof that someone was there at a given time.

Frequently asked questions

Can I check if a product is original just by scanning its QR code?

A QR scan can show you what the brand's system knows about a serial number. That helps you spot obvious fakes. It can't prove the object in your hand is the one that serial belongs to, because a QR code can be copied along with the packaging.

Are anti-counterfeit QR codes safe to rely on?

They raise the effort for counterfeiters, but they're still printed images. One-time codes, scan counters and special print features each have gaps. They work best as an extra signal, not as the main proof for high-value goods.

What makes NFC verification harder to fake than a QR code?

A secure NFC chip, such as an NXP NTAG DNA chip (424 DNA, 223 DNA or 224 DNA), keeps a secret key inside the chip. It signs a new message each time it's tapped. A copied message or a cloned chip doesn't pass the server check, so there's no static code worth copying.

Do customers need an app to verify an NFC-tagged product?

Not with TAGBASE. Most current iPhones and NFC-enabled Android phones read NFC tags without an extra app. Tapping the product opens the verification page in the browser.

Should brands replace QR codes with NFC completely?

Not necessarily. QR codes are good for information and reach. A practical setup keeps a QR code on the packaging and adds an NFC chip to the product itself where authenticity, ownership or safety matter.

See it for yourself

The easiest way to understand the difference is to tap a tag yourself. Our TAGBASE VERIFY demo kit comes with tagged samples you can test with your own phone.

If you'd rather talk it through for your product line, get in touch. We'll show you how verification would work on your items.