Checking whether a product is genuine is only possible if an institution or the brand keeps a record. For medicines the Pharmaceutical Track and Trace System (İTS), for cosmetics and medical devices the Product Tracking System (ÜTS), and for mobile phones the IMEI query of Türkiye's Information and Communication Technologies Authority (BTK) keep this record on behalf of the public. For most products there is no such record, and the QR code on the packaging only opens a web page unless the brand builds a record behind it. For the brand, the job is to decide in advance what the customer will check with which information, and what the result will and will not prove.
Where do consumers check today?
Medicines: İTS. On the medicine query screen of the İTS website, the code starting with (01) next to the barcode on the box is entered in the barcode field and the code starting with (21) in the serial number field. The result shows the medicine name, manufacturer, production and expiry dates, batch number, registration status and price. The Ministry of Health's İTS Mobil app carries out the same check by scanning the data matrix code.
Cosmetics and medical devices: ÜTS. According to the Turkish Medicines and Medical Devices Agency (TİTCK), medical devices, cosmetic products and certain biocidal products that come into contact with the human body, whether produced in or imported into Türkiye, are registered in ÜTS. The agency lists enabling citizens to query products among the system's aims. In the ÜTS mobile app, a query is made by scanning with the camera or entering the product number manually.
Mobile phones: the IMEI query. In the service offered on the e-Government Gateway (e-Devlet) in cooperation with BTK, the 15-digit IMEI number is entered. According to the service description, the result shows whether the device was imported through legal channels and whether it is lost or stolen. The IMEI number is found by dialling *#06# on the device.
Barcodes: Verified by GS1. According to GS1 Türkiye, this service shows that the GTIN queried is an active number issued by a GS1 Member Organisation, together with basic information on the product carrying it.
What do these checks show, and what do they not?
What the four checks have in common is that they show the status of a code in a record. On their own, they do not show that the physical product in your hand belongs to that code.
| Check | What it shows | What it does not show on its own |
|---|---|---|
| İTS | Whether the code is registered, batch, dates, recall | That the box and its contents belong to that code |
| ÜTS | That the product is registered in the system | That the unit in your hand is genuine |
| IMEI | Legal import and lost/stolen reports | That the packaging, accessories and parts are original |
| Verified by GS1 | That the GTIN is active, and basic product information | The product itself; the same GTIN is on every pack |
In medicines this gap is narrowed by stakeholders in the chain reporting box movements to the system. The consumer's check is only the most visible end of a much larger system. We explain this in detail in the article on İTS and the FMD.
What should a brand set up where no mandatory system exists?
For many food, textile and spare-part products where no public unit-level record is kept, a brand needs to set up the following components for customers to be able to check that a product is genuine:
- A unique identity on the product. An unpredictable code at batch or unit level. Sequential numbers are easy to derive. To make the code physically verifiable too, a copy-resistant feature is added to the packaging.
- An official check channel. The QR code can link to an address on the brand's own domain using the GS1 Digital Link structure, or the check can be made with a mobile app. Which address and app are official should be stated clearly on the packaging and the website, because a counterfeit pack can carry its own QR code and its own "genuine" page.
- A record of scans. Each query is recorded with its time and, to the extent the customer allows, its location. A second or third scan of the same code, or a scan in a region it was never shipped to, is flagged.
- Honest result wording. The page should say only what it knows, for example "This code is in our records and is being scanned for the first time", "This code has been scanned before" or "This code is not in our records". Saying "genuine" on the basis of the code record alone gives false confidence on the first scan of a copied code.
- A back-end process. A "not registered" or "scanned before" result should direct the customer to a report form, and that report should turn into an investigation. We set out the sequence in the article on counterfeit complaints.
- Verification within the chain. A consumer check works after a counterfeit has already reached the shelf. If the same channel is also used at goods receipt and by dealers, counterfeits are sorted out earlier.
How these components come together as an authentication system is covered in the article on product authentication systems. How to write the code into a QR code is in the 2D barcode article.
What can a check prove, and what can it not?
A well-built check can show:
- That the code was generated by the brand and which batch it belongs to
- Whether the code has been scanned before, and where
- Which dealer or market the product was shipped to
- Where a security feature is embedded in the packaging, that the packaging is the brand's own print
On its own, it cannot prove:
- The first scan of a copied code. When a genuine code is printed on counterfeit packaging, the first scan looks genuine. It is the later scans that give the copy away.
- The contents. Even when the packaging and code are genuine, the bottle may have been refilled. Only analysis sees the contents.
- Storage and use conditions. How the product was stored or used is not written in the code.
- That the channel is authorised. Without a shipment record, a check cannot tell whether the product was bought from an unauthorised seller.
So the result page should give the customer a summary of what was checked, not a final verdict. When a final decision is needed, the product is collected and examined.
Where does Spectrace sit in this flow?
Grafex embeds a signature invisible to the eye in the existing packaging design; the customer, dealer or field team verifies the packaging itself with a mobile app. Tagvex numbers products at batch or unit level with a copy-resistant code, keeps the shipment and scan record and flags repeated scans or scans from unexpected locations. Authex documents the listings and sellers through which counterfeits are sold. These records are for the brand's own use; they do not replace reporting obligations under İTS, ÜTS or any other regulation. How we carry out the setup is described on the tracking, tracing and verification service page.
Frequently asked questions
Does checking a product's barcode show that it is genuine?
It does not. The GTIN in the barcode identifies the product type and is the same on every pack of that type. A Verified by GS1 query shows that the number is active and gives basic product information; it does not verify the unit in your hand.
Is a medicine that shows as registered in an İTS query definitely genuine?
The query shows that the code is registered in the system and the status of the box. The system's protection against counterfeit and smuggled medicines rests on stakeholders reporting the box's movements through the chain; the consumer's query is only one end of that structure. If in doubt, ask a pharmacist; a medicine not registered in the system can also be reported through İTS Mobil.
Can the QR code on a counterfeit pack also give a "genuine" result?
It can. A counterfeit pack can carry its own QR code and open a page that resembles the brand's; that is why the official address and app should be stated clearly on the packaging and the website. When a genuine code is copied, the first scan looks genuine, and the scan record flags the later ones.
