Anti-Counterfeit Packaging: Comparing Serialisation and Security Labels

Direct answer: Serialisation and security labels address different parts of a counterfeiting risk. Serialisation assigns individual identifiers that can be checked against controlled records; a security label adds a physical feature that may help an inspector assess a package. Neither proves authenticity by itself. Define the threat, supply chain and verification process, then test the complete system on the actual packaging.

Begin with the business problem

Counterfeit or unauthorised products can affect customers, brand reputation, inventory and safety. The relevant risk differs by product and channel. A manufacturer selling through authorised distributors may need to identify duplicate serials and investigate diverted stock; another business may primarily need to help recipients inspect a sealed package. Start with the specific problem rather than choosing a hologram or QR code from a catalogue.

Map the package and supply chain from production through storage, distribution, retail and returns. Identify who can inspect, scan or change the package at each stage. Decide what information must be available to each party and who is responsible for investigating a suspicious result. The organisation’s security, quality and legal teams should determine applicable requirements for its products and markets.

A label is one control within a wider system. Supplier qualification, production controls, secure data management, distribution agreements, monitoring and incident response may also be needed. Avoid claiming that any printed feature makes a product impossible to copy or guarantees customer safety.

What serialisation means

Serialisation assigns a distinct identifier to an individual unit or another defined level, such as a carton. The identifier may be represented in human-readable form and as a barcode or two-dimensional symbol. A controlled system records the identifier and its status, allowing authorised parties to check or record events associated with it.

Specify the level of identification before designing the code. A serial on an individual retail unit serves a different purpose from a code identifying an outer case. If units are packed into cases or pallets, the organisation may need to record those relationships. An accurate parent-child record requires a controlled packing and reconciliation process; simply printing codes on each level does not create the association.

Decide who generates identifiers, how uniqueness is maintained, which records are authoritative and what happens to unused or spoiled numbers. Identifier rules and data carriers can be subject to customer, market or sector requirements. If using GS1 identification, follow the applicable GS1 specifications and allocation rules rather than assuming any unique-looking number is compliant.

What security labels can add

A security label may contain an overt feature visible to a trained inspector, a covert feature requiring a special reader, a tamper-evident construction or a combination. Examples include controlled visual patterns, specialist inks, destructible materials and labels that reveal a pattern when lifted. The feature’s usefulness depends on how it is produced, protected, inspected and integrated into an operational response.

A decorative holographic effect can look distinctive without providing a meaningful authentication system. Ask how an authorised inspector distinguishes a genuine feature from a similar-looking copy, what equipment is needed and how results are recorded. Do not disclose sensitive implementation details more widely than necessary. The supplier should explain limitations as well as capabilities.

Tamper-evident features are intended to show evidence of certain interference under tested conditions. They do not prevent every opening or prove that the contents are genuine. Review all package openings, the adhesive bond, inspection points and the process for suspicious evidence. Normal handling damage can also produce ambiguous results.

Compare the two approaches

Serialisation: can support unique-unit records, event tracking and detection of duplicate or unexpected identifiers. Its value depends on reliable identifier allocation, accurate data capture and an accessible verification process. A copied code may still return a valid result if the system does not analyse duplicate or suspicious activity.

Security label: can provide a physical inspection feature or evidence of some interference. Its value depends on the construction, package surface, inspection method and control of the feature. A label can be copied, transferred or overlooked, and an intact-looking seal does not establish the identity of the contents.

Combined approach: can associate a controlled identifier with a physical feature, but the association must be created and checked reliably. Adding a code to a label does not automatically integrate the systems. Document which party generates each element, how they are paired and what happens when either element fails inspection.

Build a threat model

Identify the product, package levels, legitimate participants and potential points of substitution or unauthorised access. Consider a copied printed code, a genuine label applied to the wrong package, a reused outer carton, a missing serial or a duplicate verification event. The purpose is to define controls and tests, not to promise protection against every imaginable attack.

Assess who will perform checks. A distributor may have a dedicated scanning system, while a consumer may only have a phone and limited time. A feature that requires special lighting or a proprietary reader may be suitable for trained staff but impractical for a customer. Decide what result each user sees and how to escalate an uncertain or suspicious result.

Define the expected response before launch. A duplicate scan is a signal that may merit investigation, not automatic proof of counterfeiting: legitimate repeated scans, returns and testing can also occur. The responsible organisation needs a documented way to review context, preserve evidence and make product disposition decisions.

Identifier generation and data controls

Establish the identifier format, generation authority, uniqueness rule and status lifecycle. Typical statuses might distinguish generated, printed, applied, released, returned and retired identifiers, but the exact model should match the operation. Prevent two active items from receiving the same identifier through controlled allocation and reconciliation.

Protect the data used to create and verify codes. Restrict access to serial ranges, production files and administrative functions. Where external suppliers print labels, agree how files are transferred, who can view them and how overruns and spoiled stock are handled. Maintain audit records proportionate to the risk and confirm responsibilities in supplier agreements.

Consider whether identifiers should be unpredictable, sequential or generated under another rule. This is a security architecture decision, not a universal printing setting. Qualified security personnel should assess enumeration risks, system capacity and the verification design. Do not place cryptographic secrets or private keys in visible artwork or a publicly readable code.

Printing and applying the codes

Choose the data carrier based on applicable standards, available space, equipment and scan points. Linear and two-dimensional symbols have different requirements. Confirm the required size, contrast, quiet zones and data structure. A QR code, Data Matrix and GS1 DataMatrix are not interchangeable merely because they look like square patterns.

Print using a validated combination of artwork, printer, substrate and consumables. Driver scaling, poor contrast or damaged printheads can produce unreadable symbols. Test the actual data length and package surface. If formal verification is required by a customer or standard, use the appropriate calibrated method; a single successful scan is not a verification grade.

At application, ensure the identifier is associated with the correct product and batch. If a label is spoiled, establish how the record is voided or replaced. Reconcile labels issued, applied, rejected and returned. A readable, valid identifier on the wrong product is still a serious association failure.

Design verification for the intended user

A verification result should be clear about what was actually checked. The system might confirm that an identifier exists and is active; that alone does not prove the physical item is genuine. If additional checks or event analysis are used, explain the result accurately and provide a route for reporting concerns without encouraging a false sense of certainty.

Control the website or application used for verification and protect it against impersonation. A printed link can be copied or replaced. Train users to reach the organisation through trusted channels and to treat requests for unnecessary personal or payment information with caution. The IT and security teams should assess the system’s authentication, availability and monitoring.

Plan for poor connectivity, inaccessible labels and legitimate repeated checks. Decide whether an offline inspection is permitted and what it can and cannot establish. Log events only as needed and protect any personal data in accordance with the organisation’s policies and applicable law. Avoid collecting location or identity data without a defined purpose and appropriate review.

Physical label and package compatibility

Test the actual label construction on the real package surface. Paperboard, coated cartons, plastic films, bottles and textured materials can affect adhesion and the appearance of security features. Record application temperature, pressure, dwell and service conditions. A feature demonstrated on a smooth laboratory panel may behave differently on a production carton.

Place the label where an inspector can see it without covering required product information or carrier markings. If it seals a closure, evaluate all other access points. Test normal handling, storage, moisture and friction as relevant. A feature that frequently fails during ordinary distribution can create false alarms and undermine confidence in the process.

For a label expected to show tampering, define the evidence and train the people who inspect it. Document how to handle an ambiguous or damaged seal. A damaged seal is not automatically proof of counterfeiting; product disposition belongs to the responsible quality and security teams.

Conduct an acceptance pilot

1. Define the scope: identify products, package levels, channels, threat scenarios, inspection points and responsibilities.
2. Document the design: record identifier rules, security feature, data carrier, label construction, equipment and verification system.
3. Generate controlled test data: use authorised test identifiers and record their status and expected outcomes.
4. Print and apply: run the real production workflow, including rejects, reprints, reconciliation and package association.
5. Test the journey: assess representative handling and exposure on actual packaging without interfering with product safety requirements.
6. Test verification: exercise valid, unknown, duplicated, retired and intentionally mismatched test cases in an approved environment.
7. Inspect and respond: confirm that users can recognise the prescribed evidence and that exceptions reach the responsible team.
8. Approve: compare outcomes against criteria defined before the trial, record limitations and assign owners for ongoing monitoring.

Set the sample plan and success criteria according to risk, supplier variation and customer requirements. Include both successful and failure scenarios. Independent review by qualified packaging and information-security specialists can help reveal weaknesses that a supplier demonstration misses.

Operational reconciliation and change control

At each production run, reconcile generated identifiers with printed, rejected, applied and released quantities. Investigate unexplained differences before release. If a label is reprinted, ensure the old copy and record status are handled according to the approved procedure. Avoid leaving a rejected but valid-looking code available for unintended use.

Document relationships between units, cases and pallets where aggregation is required. Check those relationships at the stage they are created, and manage repacking and returns as controlled events. The data system should distinguish a legitimate return or replacement from an unexplained duplicate; the exact rules depend on the operation.

Changes to package material, adhesive, printer, artwork, supplier, verification software or user instructions can affect the system. Assign an owner to assess each change and repeat relevant tests before production release. Maintain approved samples, specifications and incident contacts.

Supplier due diligence

Ask the supplier what feature is being supplied, who controls the artwork or originating materials, how production overruns are reconciled and how unused stock is destroyed. Request a description of the inspection method and limitations. Confirm whether subcontractors are used and how sensitive files or serial ranges are protected.

For software or verification services, review service ownership, access controls, event logs, uptime expectations, backup, incident reporting and exit arrangements. Clarify who owns the data and what happens if the service provider changes. A long-lived package may remain in circulation after a short-term contract ends.

Compare lifecycle costs, including design, labels, serial generation, integration, inspection, support and investigation of alerts. Use real quotations and operational estimates. A low label price is not necessarily a low total cost, and a more expensive feature is not automatically more effective against the defined threat.

Common mistakes

Calling any QR code authentication: a code is a data carrier. Security depends on the identifier, verification system, monitoring and response.

Checking only for a valid serial: a copied valid serial may be scanned multiple times. Evaluate the event history and other controls appropriate to the threat.

Ignoring the package: a genuine security label applied to the wrong product or placed on only one of several openings may not address the intended risk.

Overpromising to customers: describe the actual check and its limitations. Avoid claiming that an intact label or successful scan guarantees a product is genuine or safe.

No response process: a suspicious result has little value if nobody owns the investigation or can preserve relevant records and packaging.

Questions to take to a supplier

• What threat does each feature address, and what does it not address?
• How are identifiers generated, reconciled and retired?
• How are duplicate, unknown and returned codes handled?
• How is the physical feature inspected by each intended user?
• What happens to overruns, rejects, artwork and data after production?
• Which packaging or software changes require a new pilot?

For related physical seals, see our tamper-evident label buyer guide. For identifier and barcode workflows, see the manufacturing traceability guide. Consult the applicable GS1 barcode resources where relevant to the chosen system.

Conclusion

Serialisation provides a framework for unique records; security labels provide physical features for inspection. Their effectiveness depends on sound production, data, packaging and response controls. Test the combined workflow against a defined threat and communicate precisely what each check can and cannot establish.

Measure and review the programme

Agree a small set of operational measures with the responsible teams, such as the proportion of production identifiers reconciled, unreadable-code incidents and time taken to review an alert. Interpret these measures in context: more scans can reflect greater adoption rather than greater counterfeiting. Do not publish an unsupported percentage reduction as proof that the feature works.

Review exceptions across manufacturing, distribution and customer service. Determine whether an apparent duplicate came from a genuine return, repeated user check, data-entry error or a situation requiring investigation. Preserve relevant records and packaging under the organisation’s procedures, and document who is authorised to make a product decision.

Periodically review supplier access, unused label stock, the verification domain and inspection instructions. Reassess the threat model when a product, distribution channel or packaging design changes. A feature that served one channel may be difficult to inspect in another, so adapt the test and training rather than assuming the original approval covers every use.

Frequently Asked Questions