Originally published on Medium.
A Korean face cream, three sellers, and two sets of laboratory results that are both true.
On 24 July 2026, Hong Kong’s Customs and Excise Department, following up earlier media reports, said its officers had bought a Korean face cream during inspections in several districts, had it tested, and found a banned industrial Sudan dye. They also noted that the packaging lacked the Chinese-language safety warnings required under the Consumer Goods Safety Regulation. The product was a Medicube PDRN capsule cream, made by the listed Korean company APR.
Singapore’s Health Sciences Authority moved next. On 28 August it published the results of its own testing. HSA had sampled the cream from all three companies that market it in Singapore, and found what it described as minute amounts of Sudan IV in two samples sold by one of them, with the batch numbers named in the announcement. It had instructed a recall of those two batches two days earlier. The other two sellers were cleared.
A week later the brand published lab results of its own, for those same two batch numbers, and found no dye. Then it said something more awkward. APR stated that it had never supplied or exported product to the seller whose samples failed, and that it had no record of exporting those batch numbers to Singapore at all. Both sets of results sit on the public record. Neither side has withdrawn. Both can be true at the same time, because a batch number is a string printed on a box and not an identity attached to the thing inside it. Almost three months later, no public source we could find establishes whose jars those were.
What Singapore actually did
Three companies market the Medicube PDRN Pink Collagen Capsule Cream in Singapore: APR SG Pte. Ltd., Venus Beauty Pte. Ltd., and Rirora International Pte. Ltd. HSA tested product samples from all three.
“HSA’s testing detected minute amounts of Sudan IV in two samples of the product sold by Venus Beauty Pte. Ltd. (Batch nos: 2E122I.2E117I and 2E191G.2E193G).”
“Sudan IV was not detected in the samples submitted by APR SG Pte. Ltd. and Rirora International Pte. Ltd.”
HSA said the quantities detected “are in minute amounts and are unlikely to pose any serious health risks from previous use,” and that it had received no local reports of adverse events associated with the product to date. It instructed the recall of the affected batches on 26 August 2026. Sale of the unaffected batches was allowed to resume. Going forward, all three companies must ensure that every batch “is tested by an accredited laboratory for the absence of Sudan IV before supplying the batches locally,” and must furnish their test reports to HSA.
Two details about the sequence are worth separating from the rest. The suspension of sales came first: HSA’s own announcement says it directed all three companies to suspend sales on 31 July 2026 while it tested samples. And on 20 August, nearly three weeks into HSA’s sales suspension and six days before any recall, the cream was still listed for sale on iHerb, Shopee and Lazada with stock showing for end-of-month delivery.
On the question of where the affected jars came from, HSA’s announcement says nothing. Its only guidance on the point is addressed to shoppers: “Consumers should purchase from reputable retailers with an established presence in Singapore.”
What the brand actually said
APR responded with specifics rather than a denial in general terms. It said tests at certified institutions, including one in Korea and one accredited by HSA at the regulator’s own request, found no Sudan Red in product carrying batch numbers 2E122I.2E117I and 2E191G.2E193G. It pointed out that HSA’s testing found nothing in the samples supplied through APR’s own Singapore entity. It said its shipping and export records show no export of those batch numbers to Singapore and no supply of any kind to Venus Beauty.
And then the line that matters most. APR said it is difficult to verify whether the item tested was genuine, that it is unclear where the item came from and how it was distributed and stored, and that items bought outside official retailers cannot be verified.
That is a company with a market capitalisation and a compliance department saying, in public, that it cannot tell whether a jar with its name on it is its own. Sudan IV has been banned in Korean cosmetics since 2010. The brand has every commercial reason to know the answer, and, without the jars HSA tested in its hands, no way of finding it.
Two findings that do not contradict each other
Read the two announcements side by side and it looks like someone must be wrong. A regulator found a banned dye in batch 2E122I.2E117I. The manufacturer tested batch 2E122I.2E117I and found nothing. One of them has to be mistaken.
Neither has to be. The batch number is not a property of the jar in the way a fingerprint is a property of a hand. It is ink. It is a claim printed on packaging, and it is reproducible by anyone who can print packaging. If two different objects carry the same string, then testing one of them tells you nothing reliable about the other, and two opposite laboratory results are not a contradiction. They are two measurements of two different things that happen to be labelled identically.
This is not a hypothetical about what counterfeiters might one day do.
Reporting published on 9 October by the Korea JoongAng Daily, surveying the trade in counterfeit Korean cosmetics, lists what the fakes now replicate: packaging, batch numbers, sealing stickers, and pricing. Experts quoted in that piece say no tool is foolproof and that distinguishing a fake may require analysis of the formula itself. Batch numbers are on the list of copied features, in print, as a market trend. The Singapore episode shows why that trend matters: once batch numbers can be copied, a batch number cannot settle whose jar it is. The episode took a national regulator about a month of testing and a listed company weeks of public rebuttal, and still produced no answer.
What the remedy can and cannot do
HSA’s forward-looking condition is a sensible piece of regulation, and it is worth being precise about its shape. Every batch bound for Singapore must be lab-tested for the absence of Sudan IV before local supply, with reports filed to the authority. That binds three named importers. For product moving through those three doors, it is a genuine improvement, and consumers in Singapore are better protected today than they were in July.
It does not reach anyone selling outside those three doors, and it says nothing about where any of the three gets its stock. If APR’s export records are accurate and it never shipped those batch numbers to Singapore, then the jars Venus Beauty sold reached it by some route other than APR’s own exports, and a Sudan IV test cannot say which.
It also cannot test the jar on the shelf. Batch testing is sampling by design. It certifies a lot and infers the rest, which is the correct and only affordable method for a chemical question about a production run. The buyer is not holding a production run. She is holding one object.
And it answers a different question from the one the whole episode turned on. A Sudan IV assay establishes whether a substance is present in a sample. It does not establish who manufactured the sample. Throughout six weeks of testing across three jurisdictions, those two questions were treated as one, and they are not the same question. Chemistry can tell you what is in the jar. Nothing in this story could tell anyone where the jar came from.
The people in this story did their jobs
It would be easy, and wrong, to write this up as a regulatory failure. Hong Kong followed up media reports, bought the product in several districts, tested it and caught something real. Singapore suspended sales a week after the Hong Kong warning, tested samples from every seller rather than the most convenient one, published batch-level findings about five weeks after the Hong Kong warning, recalled precisely the affected lots instead of the whole product line, cleared the sellers whose samples were clean, and imposed a proportionate forward condition. That is a competent, fast, and fair response, and it deserves saying plainly.
The brand did the available things too. It tested, repeatedly, at certified laboratories including one the regulator itself accepted. It checked its own export records. It published results instead of going quiet.
The industry is not standing still either. Kahi has put a QR code on every box, in Korea and overseas, since December 2023, and its verification screen is better designed than most: the number choices change with every scan, and the customer has to select the number printed above the code. That raises the bar over a bare QR code, because a reprinted code has to travel with its matching printed number. But a counterfeiter who copies both together will still pass. APR applies QR authentication across its products and has used outside AI-based counterfeit detection since 2024. Amorepacific issues a certification mark to authorised sellers and runs real-time monitoring with an outside firm.
Every one of those measures is a real improvement on nothing. And every one of them binds to something other than the object. A rotating challenge still resolves to ink on a box, and in a trade where one supplier makes the contents, another the containers, and another the boxes, the boxes are available. A certification mark authenticates the seller. HSA’s advice to buy from reputable retailers authenticates the shop. A brand hotline authenticates the complaint. None of them authenticates the jar.
The scale behind one recall
The numbers around this case explain why it is not an outlier. By the Korea JoongAng Daily’s account of agency data, blocked online listings for counterfeit Korean cosmetics reached 37,544 in the first eight months of 2026, just short of the 39,295 recorded across the whole of 2025. Southeast Asia accounted for 21,266 of them, or 56.6 per cent. Europe rose from 145 to 2,224. Korea Customs seized 117,005 counterfeit Korean-brand items at the border last year, cosmetics the largest category at 35.9 per cent, and 97.7 per cent of them shipped from China. One raided factory in Guangxi held about 100,000 fake products. Bulk fakes trade on Chinese business-to-business platforms at roughly a tenth of the genuine price, then move through wholesalers and open-market sellers abroad, with Hong Kong and Taiwan as common early stops.
Hong Kong was the first stop in this story as well. Enforcement is not scarce in this market. Identity is.
What we are not saying
Neither Singapore, Hong Kong nor Korea requires a chip, a tag or any unit-level identifier on a cosmetic product, and nothing in the Singapore case would have been resolved by one being legally mandated. HSA asked a chemical question and a laboratory test is the right instrument for it.
We are not saying APR was negligent, and we are not saying Venus Beauty sold counterfeits. APR’s export records and HSA’s laboratory results are both on the public record and neither resolves the other. We do not know which it was. As far as any public source shows, nobody does.
We are also not claiming the jars were fake. Unresolved is the finding, and it is the stronger claim precisely because no party to the episode disputes it.
Who meets this problem
The shopper in Singapore who read the August recall notice, turned her own jar over, read 2E122I.2E117I off the base, and matched it to a lot the manufacturer says it never exported to her country. There is no further step available to her. She can throw it away, which is reasonable, and she will never know what she had.
The three sellers, two of whom were cleared and all three of whom now carry a per-batch laboratory testing cost created by jars that, on APR’s account, did not come through APR’s own export channel.
The brand’s own staff. APR is hiring people to police listings on platforms including Amazon and TikTok Shop, and says takedowns are usually where it ends, because legal action is slow and expensive. Part of that headcount exists because no single unit can be proven genuine or not. Item-level proof would not end listing takedowns, but it would make each one faster to justify.
And the regulator, which spent about a month of scarce testing capacity to establish a chemical result it could not attach to a manufacturer.
If you are one of these people
If you are a brand selling through more than one channel in a market. Find out now, before an incident, what you would be able to prove about a single unit that a regulator hands you. Not about a batch, and not about a shipment. One jar, one serial, one answer. If the honest answer is a printed code and your own shipping records, you are in APR’s position already and the only thing missing is the phone call.
If you are a distributor or importer. The cost of this episode landed on all three Singapore sellers, including the two that were clean. Ask what evidence you hold that separates your inventory from product you did not import, and whether that evidence survives contact with a product that carries the same batch number as yours.
If you are a regulator or a market-surveillance authority. HSA’s testing answered its question well. The gap it ran into is that a composition test and a provenance test are different tests, and only one of them exists at scale. Where a sample’s origin is material to the enforcement decision, the file should record that origin as unestablished rather than implied by the batch number printed on the carton.
If you are a shopper. Advice to buy from reputable retailers is sound and it is also the limit of what the current system can offer you. Keep the packaging and the batch code until a product is finished. It is the only record you have, and in this case it was not enough for anyone.
The question that was never asked
Across three jurisdictions, three sellers, at least five laboratory tests, one recall, and one listed company’s public statements, nobody established the thing that mattered, and none of the tests that were run could have. Hong Kong asked what was in the cream. Singapore asked what was in the cream. APR asked what was in the cream. All three got good answers.
The question was never what was in the jar. It was whose jar it was. That question had no instrument in play, and the batch number was pressed into service as a substitute for one. It is a claim about identity, and it was treated as identity, and the entire episode is what happens when the two get confused at scale.
Aeroz builds product verification and connected product infrastructure.
Aeroz, Making Authenticity Checkable. Visit aeroz.io to learn more & get in contact with our team via [email protected].
© 2026 Aeroz. All rights reserved.