In refilling, the packaging is genuine and the contents are not. Methods that measure whether packaging is genuine, covert signatures included, will therefore report "genuine packaging" even when they work exactly as designed. A serial record can flag a code being scanned again and a tamper-evident closure can flag an opening, but only analysis sees the contents.
How real is this scenario?
The 2022 Intellectual Property Crime Threat Assessment by Europol and EUIPO describes refilling empty bottles as a frequently encountered method in counterfeit alcohol. Authentic bottles are obtained by collecting empties or through the complicity of workers in the food industry, filled with cheap alcohol and sealed with counterfeit capsules, corks and films. The same report notes the reuse of original pesticide containers and passes on warnings about reused and refilled COVID-19 vaccine vials.
Türkiye has similar accounts. In a 2019 press report, the president of the country's Chamber of Agricultural Engineers described empty pesticide bottles being collected, washed and labelled, then filled with counterfeit product on top of a small amount of the real one. That raises the same question for anything sold in rigid, reusable packaging: what does a packaging check actually prove?
How is it different from copied packaging?
With copied packaging, the counterfeiter reproduces the pack, so you look for a difference in the pack itself. In refilling, the counterfeiter does not produce the pack but reuses it. The print, the label and the code are all yours. The difference you need to find lies in the pack's history and its contents, not in the pack. A method chosen without this distinction sees only half of the problem.
Which method catches what?
| Method | Does it catch refilling? | Why |
|---|---|---|
| Visual checks, overt features such as holograms | Usually no | The feature sits on the genuine pack and is still there |
| Covert signature in the packaging | No | The signature is on the genuine pack; a scan authenticates the pack, not the contents |
| Data matrix or serial number without a scan record | No | The number is real; it only says which product this is |
| Serial number with a scan record | Partly | A repeat scan of the number becomes visible; if the first use was never scanned, there is no signal |
| Decommissioning the code at sale | Partly, strong in a closed system | The code cannot be used twice, but every point of sale must scan |
| Tamper-evident closure or seal | Partly | Shows an opening; closures can also be imitated, and it depends on who checks |
| Laboratory analysis | Yes, for the unit tested | Measures the contents; not a routine check and needs a reference |
| Digital monitoring | Indirectly | Does not measure the product; may show listings for empty packs or caps if they exist |
Is a covert signature useless here, then?
It is useful, but for a different question. Because the signature does not carry over to copied packaging, it rules out copies and forces the counterfeiter to find genuine packs. Genuine packs are limited and have to be collected, which limits the scale of the operation. Authenticating packaging therefore still has value. The mistake is reading that result as authentication of the contents. Instructions for dealers and field teams should state clearly that "packaging verified" says nothing about what is inside.
What does the medicines model teach?
EU falsified medicines rules combine two elements. The European Medicines Agency explains that the anti-tampering device shows whether packaging has been opened or altered since it left the manufacturer. Pharmacies and hospitals then scan the code and take it out of the system before dispensing. Recital 27 of Delegated Regulation (EU) 2016/161 gives the purpose outright: so that the unique identifier cannot be re-used by traffickers.
The strength comes from the obligation. Every pack is read the same way. Sectors without that requirement cannot expect the same result, since a code only produces a signal when it is scanned. The logic still holds: a physical element showing an opening and a digital element recording that a code has been used complement each other. See our article on medicines track and trace for the details.
What can sectors without a mandate do?
For product groups with refillable packaging, such as pesticides, lubricants, cosmetics and spirits, these measures work best considered together:
- Rate the risk by pack and channel. A sturdy pack, a valuable product and easily collected empties mean higher risk.
- Design the closure so opening damages it irreversibly. Since counterfeit closures are used, as the Europol report shows, treat the closure as a separate control point.
- Where possible, place the code on a part that opening damages. A code that sits only on the body is reused along with the pack.
- Review scans regularly. The same number appearing somewhere else or after a long gap is a reason to start a review, not a verdict.
- Send suspicious units for content analysis. Direct products from regions showing scan clusters, complaints or price anomalies to the laboratory.
- Look at where empty packs go. Check line waste, returns and destruction processes. The Europol report notes that genuine bottles can also leave through workers.
- Set up the complaint process accordingly. If code and packaging are genuine, do not close the complaint as "genuine"; move it to a separate content-doubt branch.
How should a suspicious result be read?
A repeat scan does not always mean refilling. The same person may have scanned twice, the product may have been given to someone else, or the code may have been copied. We cover the classification of methods in the article on product authentication methods. ISO 22383 divides these features into overt, covert and forensic; within that scheme, the route to the contents lies on the forensic side. Scan data tells you where to look, and analysis answers the question.
Where does Spectrace fit in this distinction?
Grafex authenticates the packaging and rules out copied packs; it does not measure the contents. In Tagvex, the record shows how many times and where each number was scanned, and unexpected or repeated scans are flagged; if the first use was never scanned, that signal does not arise. Authex documents listing and seller findings on digital channels. The contents of a product require laboratory analysis, which is outside the scope of these three solutions.
Sources
- Europol/EUIPO, Intellectual Property Crime Threat Assessment 2022
- European Medicines Agency, New safety features for medicines sold in the EU, 2019
- European Commission, Commission Delegated Regulation (EU) 2016/161, 2016
- EUIPO, Anti-Counterfeiting and Anti-Piracy Technology Guide: ISO 22383:2020
- Diken, press report on counterfeit pesticides based on a Cumhuriyet story (Turkish), 2019
