Product authentication methods consist of features that show whether a product really belongs to the right holder, and the tools that check those features. ISO 22383:2020 groups the features into three classes according to how the check is made: overt features checked with the human senses, covert features read with an authentication tool, and forensic features that require laboratory analysis. A serial number or data matrix code does not sit neatly in any of the three, because it verifies the code's history in the record.
What is ISO 22383?
ISO 22383:2020 is a guidance standard for selecting authentication solutions for material goods and assessing their performance, and it replaced ISO 12931 of 2012. It does not recommend a particular technology. It offers criteria an organisation can use to compare solutions, starting from its own risk assessment.
According to the summary in the EUIPO anti-counterfeiting technology guide, the standard sets these criteria at two levels. For the authentication element: physical characteristics, resistance to attack and the process of integrating it into the product. For the solution as a whole: where and in what environment it will be used, the authentication parameters, the security policy and compliance with relevant regulation. An annex provides an assessment table in which the performance requirement and importance of each criterion can be recorded.
How do overt, covert and forensic features differ?
The standard compares the three classes along three axes: how information is given to the person doing the check, how elements and tools are supplied, and how the check is carried out.
Overt features appeal to sight or touch: security holograms, watermarks, colour-shifting print effects. Anyone can check them without an extra tool. For the same reason the counterfeiter can study them and, with enough investment, produce something similar. The outcome depends on how well the person checking knows the original.
Covert features go unnoticed in everyday conditions and are read with a defined tool. That tool may be a UV lamp, a dedicated reader or a mobile app. The main advantage of this class is that the counterfeiter does not know what needs copying. Set up correctly, the decision rests on the tool's measurement.
Forensic features are verified in a laboratory through expert analysis: chemical markers, material analysis, microscopic examination. The result can take days but is conclusive. That is why this is usually the layer used in disputes and legal proceedings.
Where does an overt feature reach its limit?
An overt feature supports consumer confidence, but when it is the only measure against counterfeiting two weaknesses come forward. Whether a fake is caught depends on the eye of the person checking. And the packaging can move separately from the product. The 2025 OECD and EUIPO report notes that localisation tactics, where parts or packaging are imported separately and assembled in or near the destination market, make detection harder. When the packaging itself is the target, an authentication element carried inside the packaging and invisible from outside does more work.
Grafex answers this need from the covert class: it embeds a signature invisible to the eye in the existing packaging design, the packaging is printed on the existing line, and the product is verified with a mobile app. Because the tool is a smartphone, the check is not limited to expert teams; it can be opened to dealers and end users as well.
Where does serialisation sit in this classification?
A unique serial number or data matrix code verifies the code's history in the record: whether the code exists in the system, when and where it was read, and whether it has been read before. When a code is copied, the first scan can look genuine; it is the later scans that give the copy away. Serialisation is therefore used together with physical authentication features.
Tagvex numbers products at batch or unit level and records every change of hands. A repeated scan, or one from an unexpected location, is flagged in the record.
How is the authentication element itself protected?
One of the ISO 22383 criteria is how elements and tools are supplied and produced. It is easy to overlook, yet even the strongest feature gives no protection if the label or packaging stock carrying it circulates without control. In practice this means keeping a record of quantities printed, used and destroyed, defining how files and the signature are handed over when the printer changes, and deciding who may access the authentication tools and with what rights.
How should an authentication result be used?
Three results are meaningful in the field: valid, suspicious and invalid. The real work is writing down in advance what happens after each one. An invalid product is set aside and recorded. A suspicious product, for example a damaged pack or a scan taken in poor light, is checked again with a second method. Repeated suspicious results from the same channel or the same supplier start an investigation that goes beyond individual items. Forensic analysis, where needed, is the last link in this chain.
Which criteria are used to assess a method?
In an assessment meeting, the ISO 22383 criteria turn into the following headings:
- Who verifies: an inspection team, a dealer, a customs officer or a consumer. Each has different tools and a different level of training.
- Where and how quickly: goods receipt or the point of sale needs a fast result; a dispute file needs certainty.
- Resistance to attack: the product's value and its history of being copied set the level required.
- Integration into production: the effect on packaging design, the print process and line speed.
- Recording the result: whether the scan is tied to a record.
- Regulation: in some sectors, such as medicines, the form of identification and verification is set by law.
Measured against these criteria, a single method is rarely enough for most brands. When we combine Spectrace's three methods is covered in the article on choosing a method, and the differences by sector on our industry pages.
