A product authentication system is the whole arrangement that makes it possible to check whether a product really belongs to the right holder. It consists of the identity the product carries, the tool and channel that read that identity, the record in which scans are kept, the roles that set who checks where, and the rules that say what happens after a result. A hologram, an invisible signature or a serial number is one part of this arrangement. On its own, it is not a system.
What is the difference between a method and a system?
A method is the authentication element on the product. A system also covers the setting in which that element is used. The distinction is visible in ISO 22383:2020 as well. According to the summary in the EUIPO anti-counterfeiting technology guide, the standard sets performance criteria at two levels. For the authentication element, the criteria are physical characteristics, resistance to attack and integration into the product. For the solution as a whole, they are the location and environment of authentication, authentication parameters such as speed and accuracy, a security policy protecting all components and the supply chain, and compliance with regulation.
The practical consequence is this: a strong element does not work in a weak system. If nobody reads it, if the scan result is not written down anywhere, or if it is unclear what happens after an "invalid" result, protection stays limited however resistant the element itself may be. We explain the distinction between overt, covert and forensic features and the individual methods in the article on product authentication methods. This article looks at the structure those methods sit in.
What are the components of a product authentication system?
Identity on the product. This is what gets verified: a security feature embedded in the packaging, a code at batch or unit level, or both together. The GTIN barcode on the packaging does not do this job, because it identifies the product type and is the same on every pack of that type. We explain the difference in detail in the GTIN article.
Verification tool and channel. This is who reads the identity, and with what: the eye, a UV lamp, a dedicated reader, a mobile app or a web page opened by the QR code on the packaging. The GS1 Digital Link standard defines how GS1 identifiers are written consistently within a web address and how that address links to online information and services. The choice of channel directly decides who can carry out the check.
Record. This is where codes, shipments and scans are kept. Without a record, each check stays isolated. With a record, a second scan of the same code, or a scan in an unexpected place, becomes visible.
Roles and checkpoints. This is where in the chain, and by whom, the check is carried out: line output, goods receipt, dealer, field team, consumer and, where needed, a laboratory. Each role has different tools, training and needs from the result.
Result rules. This means writing down in advance what happens after valid, suspicious and invalid results. A suspicious result is checked again with a second method. Repeated results turn into an investigation of a channel or a supplier.
Element and tool security. If label stock, print files and access to authentication tools are not under control, a counterfeiter can use the genuine element directly. Accounting for quantities printed, applied and destroyed is part of this component.
What does a system look like in practice?
The clearest example is medicines, because the components are defined by law. In the EU, Commission Delegated Regulation (EU) 2016/161:
- Defines two safety features for identity: the unique identifier, which allows the authenticity of the pack to be verified and the individual pack to be identified, and the anti-tampering device, which shows whether the packaging has been tampered with (Article 3).
- Provides for the record a repositories system managed by a non-profit legal entity set up by manufacturers and marketing authorisation holders (Article 31).
- For roles and checkpoints, requires wholesalers to verify returned products and products from certain sources (Article 20), and persons authorised to supply medicines to the public to verify and decommission the unique identifier at the time of supply (Article 25).
- Requires the integrity of the anti-tampering device to be checked as well (Article 10).
In Türkiye's Pharmaceutical Track and Trace System (İTS), each box likewise carries a unique identity through its data matrix code, and stakeholders such as manufacturers, importers, pharmaceutical warehouses, pharmacies, hospitals and reimbursement institutions report movements to the system. We compare the two models in the article on İTS and the FMD. What matters here is that in both, the method works together with an identity, a record, defined checkpoints and result rules.
Who checks, and where?
In sectors without a mandatory system, the brand builds this table itself. A typical starting distribution looks like this:
| Checkpoint | Who checks | Need | Suitable tool |
|---|---|---|---|
| Line output | Quality team | Were the code and element applied correctly? | Inline reader, record |
| Goods receipt | Warehouse staff | Fast sorting | Mobile app, record |
| Dealer and point of sale | Dealer staff | That the product came through the right channel | Mobile app, shipment record |
| Field and inspection | Field team | Documenting a suspicious product | Mobile app, photograph |
| Consumer | End user | A simple, clear result | Phone camera, web page |
| Dispute | Laboratory, legal | Certainty | Forensic analysis |
When every row of the table is tied to the same record, a result at one checkpoint gains meaning at the others too.
How does a brand choose a system?
The choice starts not from a technology but from where the problem appears:
- What is happening? Is the packaging being copied, is genuine packaging being refilled, is product leaking into unauthorised channels, or is the brand name being used online? Each needs a different identity and record.
- Who will verify? If only an expert team verifies, the choice of tools is wide. If dealers and consumers verify too, the channel needs to work with a smartphone.
- Who needs the result, and for what? Goods receipt needs speed. A seller complaint or legal proceedings need a recorded, repeatable finding.
- What can production take? The effect on packaging design, the print process and line speed decides whether the system can be sustained.
- What does regulation require? In some sectors the form of identity and record is set by law. The brand builds its system alongside it, not in its place.
For most brands the answer is to combine more than one method in the same record. When methods are used together is covered in the article on choosing a method, and which product to start with in where brand protection starts.
Where does Spectrace sit in this system?
Spectrace's three products cover different parts of these components. Grafex embeds a signature invisible to the eye in the existing packaging design; the packaging is printed on the existing line and verified with a mobile app. Tagvex numbers products at batch or unit level with a copy-resistant code, records every change of hands and flags repeated scans or scans from unexpected locations. Authex monitors how the brand is used in online channels and documents the findings. How we define roles, checkpoints and result rules together with the brand is set out on the tracking, tracing and verification service page.
Frequently asked questions
Is a product authentication system the same as a traceability system?
No. Traceability reads the product's path from the record; authentication reads from the product that the item in your hand belongs to that record. A good system combines the two in the same record. We explain the difference in the article on tracking and verification.
Is the QR code on the packaging an authentication system on its own?
It is not. A QR code is an identity and a channel. Unless the record of scans, who scans where and what happens after the result are defined, the QR code only opens an information page.
Does ISO 22383 recommend a particular technology?
It does not. It offers performance criteria an organisation can use to compare solutions against its own risk assessment; the table in its annex lets the requirement and importance of each criterion be recorded.
