A static QR code is a link printed in ink. It costs almost nothing to add, it never reports back, and it treats every scan as the first. That is the whole design: it was built to carry a URL from a poster to a phone, and for that job it remains excellent.
The trouble starts when the same square is asked to prove something: that a product is genuine, or that a cashback claim happened once, made by a buyer who exists. A static code can assert neither. Copy it once and it can be copied forever, and every copy scans as cleanly as the original.
Four costs with no line item
Ask a finance team what QR-enabled fraud cost them last quarter and you will get silence, because the losses are booked everywhere except under their own name. They travel through four channels.
- Counterfeit substitution: fakes carrying a photograph of your genuine code, sold on your reputation at close to your price.
- Grey-market diversion: genuine stock resold outside its contracted channel or geography, collapsing price integrity and dealer margins.
- Scheme abuse: cashback, loyalty and warranty claims made against codes that were shared, harvested or never attached to a sale.
- Ghost production: unrecorded runs on your own artwork at your own contract manufacturer, invisible because every unit looks official.
Each channel hides inside another budget. Substitution reads as soft demand. Diversion reads as channel conflict. Scheme abuse reads as marketing spend. Ghost production reads as nothing at all, which is what makes it the worst of the four.
The scale survives any discount
The aggregate numbers are contested at the margins and enormous at the centre. The OECD–EUIPO study Mapping Global Trade in Fakes 2025 puts global trade in counterfeit goods at USD 467 billion, about 2.3 % of world trade, working from 2021 customs data. For India, FICCI CASCADE and TARI estimate the illicit market across five consumer sectors at ₹7.97 lakh crore for 2022-23. The ASPA–CRISIL report State of Counterfeiting in India 2025 found that 35 % of Indian consumers had met a fake within the past year.
The same ASPA–CRISIL report carries the figure an economist should sit with: counterfeit FMCG sells at roughly 19 % below the genuine article. That 19 % is the counterfeiter's whole pitch. They pay nothing for development or quality control, and they pass part of the saving to the shopper as a discount funded by your brand. A photograph of your static QR code is part of the package they resell.
A clone costs one photograph
Picture a counterfeit operation weighing whether to copy your pack. The hologram costs them tooling. The moulded cap costs them a supplier. The static QR code costs them one photograph, because a code that resolves to a fixed URL resolves identically from the millionth copy. Whatever verification story your pack tells, the clone now tells it too, with a straight face.
secQR, DBTEZ's product intelligence and authentication infrastructure, works from the record side of that problem. Every unit carries its own serialised, signed code, so a copy and its original resolve to the same record, and the record sees them both arrive. We chose to flag duplicates rather than silently block them, because the pattern of duplicate scans, their count, spread and speed, is the evidence a brand-protection team takes to a distributor or a court.
The unit-cost objection is fair
Serialised codes cost more than a repeated static square. Artwork becomes variable data, the packing line needs a printer and a camera, and someone must own code provisioning. That is a real project with a real budget line, and it deserves a straight payback story rather than hand-waving.
The straight story is that payback begins before enforcement does, because the first thing a dynamic code buys is measurement.
Measurement is the first product
You cannot manage a loss you cannot count, and a static estate counts nothing.
A static estate produces no telemetry. There is no scan count and no duplicate signal, so every fraud estimate is an extrapolation from seizures and complaints. A serialised estate turns the same printed square into an instrument. Duplicate scans surface cloning. Scans from a territory you never shipped to surface diversion. Redemptions that outrun production surface ghost runs. These arrive as behavioural signals with explicit rules on top, per SKU, per batch, per territory.
Expect some of the numbers to be uncomfortable. A brand measuring for the first time usually finds its problem shaped differently from its assumption, and that discovery is the point. Budgets follow evidence, and enforcement aimed at the wrong channel is money spent on reassurance.
Enforcement and revocation follow, and they matter. The sequence is the insight. Before a dynamic code stops a single fake, it tells you what the fakes have been costing you, and that figure is the one your next board conversation is missing.