Counterfeiting is an identity attack, and identity is now something a pack can prove. Serialized QR codes, one code per item with a per-unit serial, upgrade a barcode from naming a product to naming this individual object, and cryptographic signing upgrades that to naming it unforgeably.
Level one: serials alone
A Digital Link with the /21/ segment gives each unit its own scan history. That alone enables the honeypot defences: the same serial appearing in two countries within a 30-minute window is flagged as impossible travel; a serial scanned hundreds of times, when a genuine bottle gets scanned a handful, is flagged for velocity. Suspicious scans are marked, not counted, so cloned codes do not even inflate your analytics.
Level two: signed serials
Plain serials can be invented by a counterfeiter with a sequence guess. Signed serials cannot: the brand signs each serial with an Ed25519 private key, printing serial and signature together in the code. At scan time the resolver verifies the signature against the product's registered public key, with no database lookup per item, so one keypair authenticates unlimited units. A fabricated serial fails instantly; a shopper scanning a fake sees a translated warning page instead of the product page, and machines get a hard error. The private key stays with the brand, offline; Onpack holds only the public half, deliberately, so the resolver can never be a place counterfeit serials are minted.
Level three: revocation and response
When investigation confirms a compromised serial or a stolen batch, revoke the serials: subsequent scans warn immediately. Combined with per-lot recall machinery, brands get graduated responses, from quietly flagging one suspicious serial to warning on a lot, without touching genuine stock.
What this costs against what it replaced
Item-level authenticity was historically an enterprise program: proprietary secure labels, per-item fees, vendor lock. The cryptographic path needs only printing variable codes (routine for modern digital presses) and key management the API walks through; verification, honeypots and revocation are free on Onpack. Wine and spirits brands, the classic targets, get the fuller playbook in the category guide.
Common questions
How does a signed serial stop a counterfeiter?
The serial in the code carries a cryptographic signature only the brand can produce. A fabricated serial fails verification at scan time; copying one genuine code exactly is detected by clone analytics when it appears in many places.
Does verification need an app?
No. The check happens at the resolver when any camera scans the code; the shopper just sees the verdict on the page.
What is impossible-travel detection?
The same serial scanned in two countries within a short window is physically impossible for one item, so those scans are flagged as a likely cloned code.
Where is the private key kept?
With the brand, offline. Onpack registers only the public key and verifies signatures; it never holds material that could mint serials.