Anti-copy QR codes: can a QR really be copy-proof?
Vendors sell 'uncopyable' QR codes. Buyers ask for them. The honest answer is that a QR is a pattern of black and white squares designed to survive photography, so it cannot be uncopyable. What can be made copy-resistant is the system the code belongs to, and, for brands that need it, the print itself. This page separates the two.
A printed QR code cannot be made copy-proof, because a QR is designed to be read by any camera and whatever a camera can read it can reproduce. What makes a QR anti-copy is the system behind it: a unique code per unit, a scratch panel so the code is not exposed before sale, first-scan binding that treats the first plausible scan as the genuine unit, and duplicate, geography and velocity detection that flags the same code appearing twice. For brands facing organised copying, a copy-detection pattern printed beside the QR or print-forensic analysis of the pack can identify a reproduction from its loss of fine detail, at higher cost and with more demands on the phone camera.
Why a QR cannot be uncopyable
A QR code carries error correction so that up to 30 percent of it can be damaged and it still reads. That same tolerance is what makes copies work: a photograph, a photocopy or a reprint loses detail, but not enough to stop a phone reading it. Any claim that a standard QR is copy-proof should be read as a claim about the system around it. The relevant question is not 'can it be copied?' but 'what happens when it is?'.
Where copy protection actually comes from
One code per unit
If every pack carries a different code, a counterfeiter can only copy the codes they have physically seen. A thousand fake packs carrying fifty copied codes means each code appears twenty times, which the ledger notices.
Scratch panel
Hiding the code under a scratch-off panel means codes on unsold stock cannot be photographed. The counterfeiter must buy and destroy genuine units to harvest codes.
First-scan binding
The first plausible scan binds the code to a place and a phone. Every later scan is compared against it, and the buyer is told the code was checked before.
Duplicate-scan detection
A per-SKU threshold on total scans per code, with a warning to the buyer and a flag to the brand once exceeded.
Geography and velocity anomalies
The same code in two states, consecutive serials scanned in minutes, or scans in a market the batch was never shipped to, are scored as suspect.
Reconciliation
Voiding codes that were generated but not printed makes a leaked code file worthless.
Together these mean a copied code is caught as soon as both the genuine and the copy are scanned, and often before, when the copy is scanned in the wrong place. The QR program fraud prevention guide sets out thresholds observed across programs Unotag runs, and anti-counterfeit QR codes covers the serialisation side.
Making the print itself copy-resistant
Two further techniques act on the print rather than the system. A copy-detection pattern (CDP) is a dense, noise-like graphic printed at the resolution limit of the press beside or inside the QR. A genuine print holds that detail; any reproduction, which is a print of a scan, loses a measurable fraction of it. A phone photo compared against the original pattern gives a score. Print forensics goes further and examines the halftone structure, ink spread and substrate of the pack as a whole; it needs no special pattern but demands a good camera and controlled capture. The print forensics post is candid about its limits.
Both are real and both work, with three caveats. They need higher-quality printing than a standard label, they are sensitive to lighting and focus on a consumer phone, and they raise per-unit and platform cost. They are worth it when a brand is losing to organised copying that reproduces genuine codes one-for-one; they are unnecessary for the majority of Indian counterfeits, which carry no code, a fake code or the same code on every pack.
The approaches compared
| Approach | Added cost per unit (observed) | Consumer phone readability | Attack it defeats | Attack it does not |
|---|---|---|---|---|
| Serialised QR, no panel | ₹0.05 to ₹0.80 | Excellent | Fake codes, repeated codes, guessed codes | A copied code scanned before the genuine unit |
| Serialised QR under scratch panel | Add ₹0.30 to ₹0.70 | Excellent after scratching | Harvesting codes from shelf stock | Codes harvested by buying genuine units |
| First-scan binding plus duplicate and geo rules | Platform cost, no print cost | Not applicable | Copies scanned after or far from the genuine unit | A single copy scanned once in a plausible place |
| Copy-detection pattern beside the QR | Add ₹0.20 to ₹1.00 plus higher print spec | Good in daylight with steady focus; weaker on low-end phones | One-for-one reproduction of a genuine code | Photographs taken in poor light give uncertain scores |
| Print forensics on the whole pack | No print change; platform and capture cost | Field officer capture, not consumer | Reproductions of the pack regardless of code | Counterfeits printed on the same class of press |
| NFC tag | ₹8 to ₹25 | NFC phones only | Cloning without chip-level attack | Cost limits it to high-value items |
What to choose
- Every brand: serialised codes, reconciliation and the ledger rules. These catch the bulk of counterfeits and cost almost nothing extra.
- Categories where codes are harvested on shelf (seeds, pesticides, cosmetics, spare parts): add the scratch panel.
- Brands seeing genuine codes reproduced one-for-one: add a copy-detection pattern on the most-copied SKUs and use print forensics in field investigations.
- High-value units: NFC or a hologram with serial, on top of the above rather than instead of it.
The selection guide has the questions to ask any vendor claiming copy-proof codes; the most useful is 'show me what your system says when I scan a photocopy'.
A worked example: what the ledger sees
A counterfeiter buys one carton of a paint brand's most popular one-litre pack, twelve units, and photographs the twelve visible QR codes. They print two thousand fake packs, each carrying one of the twelve codes, and ship them to shops in three districts. Within a fortnight the ledger shows twelve serials with scan counts in the dozens, spread across districts the batch was never dispatched to, from many different phones. Any consumer scanning one of the fakes after the first few sees 'this code has already been verified many times' and a report button. The brand's field team gets a map with three clusters and visits the shops. None of this required a special print, and the twelve genuine units may never have been scanned at all.
Now repeat the example with the code under a scratch panel. The counterfeiter must buy and scratch twelve genuine units to harvest the codes, which is cheap once but does not scale, and each harvested code still trips the duplicate rule the moment it is reused. Add a copy-detection pattern and even the first scan of a fake returns a low print-quality score. Each layer narrows the window; none is needed unless the attack you observe calls for it.
Testing a vendor's claim in an afternoon
- Ask for ten serialised sample labels and apply them to your own packs.
- Scan one genuine label in the office and confirm the verdict and the ledger entry.
- Photocopy the same label, scan the copy from another phone, and read what the consumer is told.
- Photograph a label, send it to a colleague in another city, and have them scan the reprint.
- Scan five different labels from one phone within a minute and check whether velocity is flagged.
- Type a plausible but unissued code into the WhatsApp flow and confirm it is rejected.
A system that passes all six has done the work that matters. A system that returns 'genuine' to the photocopy without a warning, or that accepts the invented code, is a marketing QR with a database behind it.
Key takeaways
- No printed QR is copy-proof; error correction guarantees a copy reads.
- Copy resistance comes from the system: unique codes, scratch panels, first-scan binding, duplicate and geography detection, reconciliation.
- Copy-detection patterns and print forensics catch one-for-one reproductions at higher cost and with stricter capture needs.
- Match the layer to the attack you actually see in the market.
Frequently asked questions
Can a QR code be made copy-proof?
No. A QR is designed to be read by any camera and therefore any camera can reproduce it. Copy resistance comes from unique codes per unit, scratch panels, first-scan binding and duplicate detection, with copy-detection patterns as an added layer for organised copying.
What are anti-copy QR codes?
Serialised QR codes backed by a system that detects copies: each unit has a different code, the first scan binds it to a place, and later scans elsewhere or in excess are flagged. Some add a copy-detection pattern that reproductions cannot hold in full detail.
How does a copy-detection pattern work?
A dense noise-like graphic is printed at the limit of the press. A genuine print retains its fine detail; a copy is a print of a scan and loses some. The phone photo is scored against the original pattern to estimate whether it is first-generation print.
What happens when a counterfeiter copies a genuine QR code?
The copy carries the same serial as the genuine unit. When both are scanned, or when the copy is scanned in the wrong district or too many times, the ledger flags it and the buyer is told the code was already verified elsewhere.
Do scratch panels stop QR codes being copied?
They stop codes being photographed on unsold stock, which is the cheapest way to harvest genuine codes. A counterfeiter must then buy genuine units to obtain codes, and each harvested code still trips duplicate detection once reused.
How much does QR copy protection add to packaging cost?
Serialisation itself costs ₹0.05 to ₹0.80 per unit across programs Unotag runs; a scratch panel adds ₹0.30 to ₹0.70; a copy-detection pattern adds ₹0.20 to ₹1.00 plus a higher print specification. Ledger rules cost nothing per unit.
Is a hologram better than an anti-copy QR code?
Holograms are themselves copied and cannot be verified against a database. A hologram with a serialised code combines a visual cue with a verifiable record; the serial does the protective work.