Over the last decade, Indian FMCG brands have tried essentially every available anti-counterfeit technology. Security holograms. Scratch-off codes. UV-reactive inks. QR codes pointing to brand websites. Serialised QR codes pointing to cloud databases. Each one was adopted by some brands, promoted by vendors, and eventually abandoned or supplemented — because each one had a ceiling that sophisticated counterfeiters quickly reached.
Cryptographic authentication is different in a specific, technical way. Understanding why requires understanding where the previous approaches failed.
Why holograms failed
Security holograms were the gold standard of anti-counterfeit packaging for 20 years. A well-made hologram was difficult and expensive to replicate — for a while. The problem is that hologram printing technology improved at the same rate as the holograms themselves. By 2010, sophisticated counterfeiters operating at scale could produce holograms indistinguishable from genuine ones to the naked eye. By 2015, cheap hologram-printing services were operating openly in industrial areas of Tier 2 cities.
"The moment an anti-counterfeit feature can be visually replicated, it has failed. The only question is how quickly the counterfeiters reach that threshold."
Brand protection consultantWhy QR landing pages failed
The QR code revolution offered a more scalable approach: put a QR code on every pack, point it to a verification page, let consumers check authenticity themselves. The problem was architectural. A QR code is just a URL. Any counterfeiter can generate a QR code pointing to a fake verification page that looks identical to the genuine one. The consumer scans, sees "Authentic!", and has no idea they're looking at a cloned page.
Serialised QR codes — where each code contains a unique serial that's checked against a database — improved the picture. But they introduced new failure modes: database availability (if the verification server is down, everything fails), replay attacks (a counterfeiter can copy a genuine serial and reuse it across many units), and the fundamental problem that the database, not mathematics, is the source of trust.
Why cryptographic authentication is architecturally different
ECDSA (Elliptic Curve Digital Signature Algorithm) signing moves the source of trust from a database to mathematics. At Ratifye, every barcode is signed with a private key held in a hardware security module at generation time. The signature is embedded in the barcode data.
To verify, a scanner extracts the signature and the barcode data, and uses the public key to verify the signature. This verification is entirely mathematical — it doesn't require a database lookup, a network connection, or any external dependency. And it cannot be forged: the only way to produce a valid signature is with the private key, which never leaves the HSM.
Why a counterfeiter cannot defeat cryptographic authentication
- Copying the barcode copies the signature — but the signature is bound to that specific GTIN + serial + batch
- A 'replay' attack is detectable: if the same serial is scanned twice in different locations, that's an alert
- Generating a new signature requires the private key, which is in a hardware security module
- The mathematics of ECDSA means brute-forcing the private key would take longer than the age of the universe
- Unlike holograms, there is no 'good enough' replication — a fake signature fails instantly
What the transition looks like for FMCG brands
For most FMCG brands, the transition to cryptographic authentication doesn't require new packaging or new hardware. The EAN-13 or QR code already on your pack becomes the carrier for the cryptographic signature. Your existing scanner infrastructure gets the Ratifye SDK in 3 days. Authentication becomes part of every existing scan operation — with zero workflow change for your warehouse and distribution teams.
See cryptographic authentication working on your actual barcodes.
Bring your GTIN to a Ratifye demo and we'll run a live authentication in the first 5 minutes. Most demos end with a clear go-live plan.
Book a 20-min demo
