A product scan is one of the highest-intent moments a brand ever gets. The consumer is holding the physical product, their phone is already out, and they've made the deliberate choice to engage further — not scroll past an ad, not skip a pre-roll, but actively point a camera at a code to learn more. Last week's piece covered why most brands never capture this moment at all. This one covers what to do with it once you have.
The mistake most brands make when they do build a scan experience is stopping at "Genuine Product — Verified." That's a real, useful result — it's the whole reason anti-counterfeiting QR codes exist. But it's also a dead end. The consumer learns one fact and closes the browser tab. The brand spent the engineering effort to build a verification flow and got exactly one outcome from it: confirmation. Nothing about that moment compounds, builds a relationship, or drives the next purchase.
What Goes on the Result Screen After "Genuine"
The authentication result is prime real estate, and most brands waste it on a single line of green text. The moment a scan confirms a product is genuine is also the moment to do something with the attention that confirmation just earned. In practice this means treating "Verified Genuine" not as the end state of the screen, but as the header above it — with the actual content underneath built around one or more of three goals: capture a loyalty touchpoint, nudge a replenishment, or surface a relevant cross-sell.
Which of the three to lead with depends entirely on the category, the purchase cycle, and what's actually permissible to say. That's the reason this needs a vertical-specific playbook rather than one generic template — what works for a cosmetics brand would be a regulatory problem for a pharma one, and what drives a liquor brand's repeat purchase has no equivalent in FMCG.
The Playbook, Vertical by Vertical
Serialized Coupons: Where Upsell and Anti-Fraud Are the Same Mechanism
It's worth dwelling on the FMCG coupon case, because it's the clearest example of how authentication and marketing infrastructure aren't actually two different systems — they're the same unit-level serial doing two jobs. A traditional coupon code is a shared secret: the same code printed on every pack in a batch, or the same code texted to a thousand people. The moment that code leaks — photographed, screenshotted, posted to a deals forum — it can be redeemed far more times than the brand intended, and distinguishing a legitimate redemption from a leaked one after the fact is close to impossible.
A serialized code sidesteps the entire problem by construction. Each physical unit carries a unique identifier, that identifier can be redeemed exactly once, and the redemption event is tied to the same commissioning record already used to prove the unit is genuine. There's no separate "coupon fraud" system to build, because the fraud resistance is a property of the same serialization layer doing authentication. The brand gets a promotion mechanic that can't be gamed at scale, without a second piece of infrastructure to maintain.
| Mechanic | Shared/Static Code | Serialized, Unit-Level Code |
|---|---|---|
| Redemption limit | None — same code works for anyone who has it | Exactly once, tied to the specific unit sold |
| Leak exposure | One screenshot defeats the entire promotion | A photographed code is still only redeemable once, by whoever scans first |
| Fraud detection | Reactive — noticed only after redemption volume looks wrong | Structural — a second redemption attempt is simply rejected |
| Infrastructure | Separate promotions/coupon system | Same commissioning record used for authentication |
Measuring What Actually Matters
A scan-based engagement layer produces a different kind of metric than a traditional marketing campaign, and it's worth being deliberate about which ones matter. Three are worth tracking from day one:
- Scan rate — what share of units sold are actually being scanned at all. This is the baseline that tells a brand whether the code is being noticed and whether the value proposition on the landing page is compelling enough to act on.
- Repeat-scan rate — what share of consumers who scan once come back and scan a different unit later. This is the real loyalty signal, distinct from a one-time novelty scan, and it's the number that should move first if a loyalty mechanic is working.
- Scan-to-conversion — what share of scans lead to a tracked action: a coupon redemption, a replenishment click-through, a cross-sell add-to-cart. This is the number that ties the engagement layer back to revenue, and the one worth reporting up to whoever approved the budget for it.
None of these require new instrumentation beyond what the serialization and scan-event layer already captures. They're a reporting question, not an engineering one — which is part of why this layer is cheap to add once the authentication infrastructure already exists.
DPDP consent. Anything beyond anonymous scan data — a phone number for loyalty points, an email for a certificate — needs explicit consent captured at the point of collection, not bundled into a pre-ticked box.
No dark patterns. A loyalty mechanic that makes redemption deliberately confusing, or a "verify and win" flow that buries the actual authenticity result beneath a marketing funnel, undermines the trust the authentication layer is supposed to build in the first place.
Pharma promotion limits. Content behind a scan on a prescription medicine stays within what's permitted for patient information and adherence support — this is not the layer to test the boundaries of drug advertising rules.
What This Looks Like in the First 90 Days
Brands reading the five-category playbook above sometimes assume it means building five different experiences at once. In practice, the rollout that works is narrower and sequenced, mirroring the same incremental approach covered for consumer engagement generally: it starts with the category where the upsell is easiest to justify internally, not the one with the biggest theoretical payoff.
- Weeks 1–2: Pick the lowest-friction category first. FMCG's serialized coupon or cosmetics' replenishment reminder are usually the fastest to greenlight, because neither requires legal sign-off the way a pharma adherence flow or an alco-bev event invite does. Build the result screen so "Verified Genuine" is the header, not the whole page.
- Weeks 3–6: Run it on one SKU range and watch scan rate. This is purely a measurement period — the goal is a real baseline for scan rate and repeat-scan rate before expanding, not a finished campaign. A surprising number of brands find their scan rate is higher than expected once there's an actual reason to scan beyond authenticity.
- Weeks 7–10: Add the second mechanic. Once there's real scan-behaviour data, layer in a second element — a loyalty points accrual on top of the coupon, a cross-sell recommendation on top of the replenishment nudge — informed by what the first phase actually showed about consumer behaviour rather than guessed at upfront.
- Weeks 11–13: Expand to the next category. With one working, fraud-resistant, measured mechanic in production, the case for extending it to pharma's adherence layer or alco-bev's age-gated content is a data-backed internal pitch rather than a leap of faith.
The throughline across all five verticals and this rollout sequence is the same: the authentication layer was never the ceiling on what a barcode could do, just the first thing most brands happened to build. Everything in this playbook sits on top of infrastructure a brand serious about anti-counterfeiting already has reason to install.
Where This Connects Back to Authentication
None of this works as a bolt-on to a generic QR code pointing at a static webpage. The fraud-resistance of the serialized coupon, the unit-specific certificate for a luxury buyer, the replenishment date tied to an actual purchase — all of it depends on the scan being tied to a real, unique, commissioned unit rather than a SKU-level code anyone could reprint. That's the same unit-level serialization infrastructure covered across every post on this blog about counterfeiting, diversion, and compliance. The upsell layer isn't a separate project from the authentication layer. It's the same data, pointed at a second use.
Your authentication layer is already built. The upsell layer is a configuration away.
Ratifye can show you what a loyalty, replenishment, or serialized-coupon mechanic would look like on your existing SKUs — no new serialization project, just a second use for the one you already have.
Book a demoSources: Harvard Business Review on customer acquisition vs. retention cost; Bain & Company on retention-driven profit impact; Antavo Global Customer Loyalty Report 2024 on redeemer spend multiples; industry reporting on serialized and single-use coupon mechanics for fraud prevention. Figures are the most recent publicly available estimates at time of writing and are cited for directional reference; consult primary sources and legal/regulatory counsel for category-specific compliance decisions, particularly for pharmaceutical and alcoholic beverage promotions.
