Originally published on Medium.
Thirty-five articles in this series have described what cannot be proved about a product. This one describes what can, how the mechanism actually works, the five things it still does not establish, and the one approach that answers the hardest of them. The clearest statement of the limit was published by a competitor.
On 23 September 2026, the authentication vendor Selinko published a sentence that every company in this industry, ours included, should have to write down before it sells anything.
“Tag authenticity is not product authenticity.”
The same page goes on: a cryptographic tag “cannot prove by cryptography alone that the surrounding product was genuinely manufactured by the brand,” and secure NFC “is best described as a strong hardware-backed authentication layer, not as an absolute guarantee of product authenticity.”
That is a competitor, publishing the ceiling on its own technology. We are quoting it because it is correct, because it is better stated than we have managed, and because this series has spent thirty-five articles describing other people’s failures without once setting out what our own side of the problem actually does. This is that article.
What the European standards now require
Start with the law, because it has moved and most summaries have not caught up.
CEN and CENELEC have published eight standards for the EU digital product passport. Six were cited as harmonised standards in the Official Journal on 15 July 2026 through Implementing Decision (EU) 2026/1736: data exchange protocols (EN 18216), unique identifiers (EN 18219), data carriers (EN 18220), data storage, archiving and persistence (EN 18221), APIs for passport lifecycle management and searchability (EN 18222), and system interoperability (EN 18223).
The two that deal with security were published later. EN 18239 on access rights management, information system security and business confidentiality, and EN 18246 on data authentication, reliability and integrity, were published in September 2026 and have not yet been cited in the Official Journal. Publication as a European standard and citation in the Journal are different events, and the presumption of conformity follows the citation.
EN 18220, the carrier standard, names QR codes, Data Matrix, RFID and NFC. It addresses encoding, print and read quality, error correction so a damaged label still reads, durability against lifecycle conditions including textile washing, abrasion and sun exposure, and placement on the product, its packaging or accompanying documentation. At least one carrier has to be free to use and readable with an ordinary smartphone, with no app to download, which is a genuinely good requirement.
And it explicitly excludes cryptographic security, which is left to the security standards.
EN 18246 is where authenticity lives, and what it provides is an electronically signed data construct, implementable through mechanisms including W3C Verifiable Credentials, an eIDAS electronic attestation of attributes, a Visible Digital Seal under ISO 22376, or a digital signature data structure under ISO/IEC 20248, with audit logging so that tampering can be detected and attributed.
Now the sentence that matters most in this whole piece. None of the eight standards addresses whether the physical object in your hand is the object the passport describes. They govern the carrier’s readability and the data’s integrity. And identification, as the trade coverage of the standards notes, can be implemented at model, batch or individual-item level, so a compliant identifier need not identify an item at all.
A digital product passport, fully conformant, signed, with a complete audit trail, tells you that the data is genuine and unaltered. It does not tell you that the thing it is stuck to is the thing it is about.
How the strongest available mechanism actually works
It is worth being concrete, because “NFC” covers two completely different things and the difference is the whole subject.
A basic NFC tag stores data in plain, readable memory. You can read it and write the same data to another tag. Copying it works, which means a basic tag proves nothing at all.
A secure chip, of which the NXP NTAG 424 DNA is the common example, works differently. Three parts matter. An AES-128 symmetric key sits in hardware-protected memory and is not returned during ordinary reads. A monotonic counter increments on every tap. And an on-chip engine computes a code, called a SUN message, using AES-CMAC over the chip’s unique identifier, that counter, and session data. The result is a different valid value on every tap, verified by a backend that holds the key.
So the backend can establish that the response came from a chip holding the right key, and that this particular tap has not been seen before. That is real cryptography doing real work, and it is not defeated by photographing a code or copying a URL. Cloning requires extracting a key from hardware, which, as Selinko puts it, “requires specialist equipment whose cost exceeds any return from counterfeiting individual products.” Note the form of that claim: it is an economic argument, not an impossibility proof, and it is the honest way to state it.
Two deployment facts sit underneath. NXP ships chips with documented default transport keys and recommends changing them during personalisation, so a secure chip badly personalised is not secure. And the backend has to record and enforce counter freshness, or replay works.
What it proves
Set out plainly, a correctly deployed cryptographic tag with a correctly run backend establishes two things.
This response came from a chip that holds a key issued by the brand. And this tap is new.
That is genuinely valuable and it is more than any printed identifier can do. A serial number proves a number was issued. A hologram proves somebody can print a hologram. A batch code proves ink. The cryptographic tag is the first mechanism in this series that resists reproduction rather than merely being difficult to reproduce.
Everything that follows is about the distance between those two statements and the thing a buyer actually wants to know.
The six things it does not prove
One: that anybody looked. This is the largest and least discussed. Selinko puts consumer scan rates at between 5 and 15 per cent of units sold, which means 85 to 95 per cent of products are never authenticated by the person holding them. Their conclusion is the one to sit with: “Counterfeit products moving through normal channels will not, on average, trigger an authentication failure. They are invisible to the system because the system is never engaged.” A verification layer is a mechanism for moments of doubt. It is not a monitoring system, and a counterfeit that arouses no doubt is never tested.
Two: that the tag is on the product it was issued for. Selinko’s own attack table lists physical transplant, removing a genuine chip and attaching it to a fake product, and concedes that physical integration “does not by itself prove that the tagged component belongs to the product being presented.” Their blunter line is better: “A chip that can be peeled off intact is only as secure as the adhesive.” This is the refilled-bottle problem with better cryptography. Whoever holds the genuine object holds the genuine tag.
Three: that a genuine product is where it should be. “Authentication confirms whether a product is genuine. It does not confirm whether the product belongs in the channel where it is being sold.” A diverted genuine unit, parallel-imported or stolen, passes perfectly, because it is genuine. Every grey-market problem is invisible to an authenticity check by construction.
Four: that the record will still be there. A cryptographic chip linked to a product record that has been deleted or allowed to expire produces no authentication signal at all. For spirits and luxury goods, records may need to last decades, which is an institutional commitment rather than a technical one. This is the same dependency we wrote about last week in Kenya, where a national mark is issued against a register whose own deadline lapsed, and the week before in Maharashtra, where a spectrometer’s verdict depends on a reference library the vendor conceded could be manipulated. The authority always lives somewhere else.
Five: that the contents are what the label says. In May, oxytocin injections from a licensed Indian manufacturer with forty years of history, in genuine packaging, with genuine records, were given to women after caesarean sections in Kota. Laboratory testing established the active ingredient was absent or too low. Seven women died within two months. Every identifier on those vials was real. A cryptographic tag would have verified them all and told the pharmacist nothing, because the pack genuinely was the pack it claimed to be. That failure needs a spectrometer, not a chip.
Six: that a copied identifier has not arrived first. This is the sharpest of the six and the least intuitive, and it applies to any system that resolves to a record of issued identifiers. If a counterfeiter holds a list of genuine identifiers and applies them to fake product, the first unit presented to a scanner passes, because at that moment the record says the identifier is live and unused. The duplicate becomes visible only when the same identifier is presented a second time, and only if the genuine unit is also presented. Writing in a peer-reviewed journal in 2017, Roberto Frontini named this the European medicines scheme’s biggest weakness: criminals holding a list of codes “could put the UI on falsified packages and enter the drugs into the market,” and the first code decommissioned “will be recognized as authentic even if it was on the falsified package.” Cryptography changes the economics of obtaining that list. It does not change the ordering problem, because the system is answering a question about a record rather than about an object.
What happened when a continent actually built this
Everything above is reasoning about mechanisms. There is one place where a verification system has been built at national scale, run for years, and then assessed in public by the government that mandated it, and it is the best evidence available about what any of this does in practice.
Under the EU Falsified Medicines Directive, every prescription pack in Europe carries a unique serial number checked against a central repository before it reaches a patient. EMVO reports the European Medicines Verification System handling roughly fourteen billion transactions a year across some 1,800 connected manufacturers and more than 145,000 end users. It is the most complete register of pharmaceutical identifiers in the world.
Start with the case that supports the technology, because it is real. On 18 October 2023 the European Medicines Agency alerted patients and health professionals to falsified Ozempic pens found at wholesalers in the EU and the UK. In the agency’s words, the pens carried “batch numbers, 2D barcodes and unique serial numbers from genuine Ozempic packs.” Every number on them was correct and the barcodes scanned cleanly. What exposed them is the sentence to remember: “When the packs of the falsified Ozempic were scanned, the serial numbers were shown to be inactive.” The genuine packs those numbers were copied from had already been dispensed, so the identifiers had already been retired.
The fakes failed a lookup, not an inspection. Nothing a pharmacist could read, photograph or compare would have revealed anything wrong. That is serialisation working, and it is the strongest published case for it.
Now the scale. In its report to the Parliament and the Council on trends in the falsification of medicinal products, published on 4 July 2024, the European Commission puts the figure at “11 confirmed cases of falsified medicines since 2019,” attributed to the EMA.
Eleven, against roughly fourteen billion transactions a year.
Two honest caveats, both of which the Commission supplies itself. It does not state that those eleven were detected by the verification system. And it says directly that “it is not possible at this stage to draw clear conclusions on the actual ability of the EMVS to effectively detect all falsified medicinal products throughout the supply chain.” The figure also does not reconcile with every published count: German trade press, summarising the same EMA analysis, reported 67 confirmed falsifications in the legal EU supply chain between 2017 and 2022, 21 of them in the Netherlands and 13 in Germany, while noting that member states define a confirmed case differently. Different scopes, different definitions, no reconciliation available. What every version shares is the order of magnitude: tens of cases, not thousands. The Commission’s own commissioned study, completed in December 2023, found that of sixteen national competent authorities that shared data, only two reported a single confirmed case each since 2019, Belgium in 2020 and Finland in 2019, with confirmed cases falling from 24 in 2017 to 3 in 2022 and averaging about thirty packs per case.
There are two readings of a number that low and the honest position is that the evidence does not settle between them. Either there is very little falsification inside the legal European chain, which the Commission says is plausible because most falsification is detected in the illegal chain. Or the system is not finding what is there, which the Commission’s own study also offers. Both are live.
Then there is the environment the check actually runs in. EMVO’s target alert rate is below 0.05 per cent of scans. The Commission reports that in seven countries it ran between 0.16 and 1.17 per cent, and its assessment is blunt: “Many automated alerts are not subsequently confirmed in the form of falsified medicinal products,” and “some IT systems developed at national level still trigger a level of false alerts that is too high.” The cleanest published breakdown comes from Bulgaria, where a peer-reviewed study of 2024 national data found alerts at 0.062 per cent of all scans, of which 73.57 per cent were attributed to technical reasons and 26.43 per cent to procedural ones.
Pharmacy staff therefore see alerts regularly, almost none of which mean anything, and a real one looks the same as the rest. That is not an argument against the system. It is the operational condition under which every one of its detections has to be noticed by a human being at a counter.
And the register is not complete, in ways that are documented and quantified. On EMVO data from September 2023, the Commission reports that 26 per cent of medicines carrying safety features are not checked out of the repository when dispensed. Those packs leave the chain with their identifiers still active, which, by limit six, is exactly the raw material a cloner needs. Aggregation, which would let a pallet declare the packs inside it, is “not regulated in the Delegated Regulation” and is voluntary, so verifying a pallet means opening it. And since 1 January 2025, under the Windsor Framework, UK medicines no longer carry the safety features at all: the MHRA’s guidance states that “there will be no serialisation in the UK.” A major European market left the register entirely.
Read the 26 per cent figure against limit six and the result is uncomfortable. Whichever pack reaches a scanner first is the one the system calls genuine. In October 2023 the fakes happened to arrive second. Nothing in the design guarantees that order.
The one approach that answers limit two
Every mechanism described so far is extrinsic. Something is added to the object: a printed code, a stamp, a chip. That is precisely why limit two exists, because anything added can be removed and added to something else.
There is a different family, and it is worth understanding properly because it is the only thing in the field that attacks that limit at its root. A physically unclonable function uses randomness that is already in the object, produced by the manufacturing process and not controlled by anyone, including the manufacturer.
It comes in two forms that get confused with each other.
In silicon. EUIPO’s own Anti-Counterfeiting and Anti-Piracy Technology Guide describes PUF as “a new approach to unique chip identification, authentication and the generation of ‘on-chip’ keys,” and says the most suitable form for RFID is silicon-based. Its explanation of the physics is the clearest short version available: “Every chip is unique, thanks to random, uncontrollable microscopic imperfections in the molecular structure of the material used to produce the chip.” Those identifiers, EUIPO says, “can be stored in a secure database, where they are cross-checked to authenticate originals and detect cloned chips.” On cost it says only that the costs “reflect those of the RFID tags (passive, active, semi-passive) it is used on.”
In the packaging itself. The more interesting form needs nothing added at all. In a systematisation-of-knowledge paper on paper-surface identifiers, Anirudh Nakra and Min Wu of the University of Maryland and Chau-Wai Wong of NC State set out where the randomness in a sheet of paper comes from: “During forming, the paper fibers are left to intertwine with each other and they entangle non-deterministically.” Their conclusion is that “it is due to forming that the PUF properties of paper surfaces arise,” and they note that they are the first to say so explicitly: “we are not aware of any past studies that explicitly justify why this is true.”
The identifier is extracted by imaging the surface and building what the literature calls a norm map, a two-dimensional map of the three-dimensional surface normals, from several images taken under different lighting or orientations. In practice that means a flatbed scan at four rotations, or four or more mobile camera images. The manufacturer enrols template norm maps into a reference database, and anyone downstream queries it.
Why this matters for limit two is simple. The identifier is the object. You cannot peel a paper surface off a carton and stick it on a different carton, because the surface is the carton. Transplant, the attack that defeats every added tag and that a competitor’s own documentation concedes integration does not categorically prevent, has no purchase here.
The same authors are blunt about the alternatives, and they are academics rather than vendors. Printed and tagged identifiers, they write, are “easily duplicable using easily available devices like mobile phones” because of “their unencrypted design,” and “Bar/QR codes and RFID tags have severe security shortcomings.” They also note that specialised physical tags “often require special proprietary infrastructure and are relatively expensive.”
The accuracy numbers they cite from prior work are striking enough to state carefully. Norm-map systems are reported with equal error rates “of the order 10^-100 to 10^-10,” against barcode and RFID authentication error rates “at the order of 0.01 to 0.1.” Those are cited figures from earlier studies rather than measurements the paper makes itself, and the gap is so large that it should be treated as an indication of the approach’s ceiling rather than a benchmark anybody has met in production.
And the costs are real. Enrolment is fussy: the authors note that in registration “any slight misalignment causes a significant drop in performance,” which is why scanners are preferred over phones at that stage. The surface can be destroyed: crumpling, wetting, printing or scribbling will deny service, as will tearing and scratching, though the authors reasonably observe that such damage is “visually obvious and can be used to flag potential counterfeit products.”
Their own statement of where the field is remains the honest summary: “no work thoroughly tests all of these metrics on deployable anti-counterfeiting systems.” They add that prior robustness studies “did not consider heavily destroyed patches,” that distinguishing natural degradation from deliberate attack is “a critical aspect that has not been explored in the current literature,” and that “visual features have limitations as they are brittle to different capturing conditions.”
So: a real answer to the hardest limit, at the cost of an imaging step, an alignment problem, a fragile substrate and a literature that has not yet tested it at deployment scale.
What every one of these mechanisms has in common
Now put all of them side by side, because this is the finding that only appears when you do.
A printed serial number resolves to a serialisation database. A cryptographic tag resolves to a backend holding the key and the counter. A national mark, as Kenya is building, resolves to a state register. A Raman spectrometer, as Maharashtra has deployed, resolves to a library of roughly five thousand reference spectra, and the vendor’s own representatives conceded that the data entered into those machines could potentially be manipulated. And a physically unclonable function, in either form, resolves to a template store: EUIPO’s “secure database,” or the paper authors’ “reference database” of enrolled norm maps.
There is no mechanism in this field that does not resolve to a record somebody maintains.
That is not a defect to be engineered away. It is what verification is: a comparison between something in your hand and something somebody wrote down earlier. The physics changes which comparison is cheap and which attack is expensive. It never removes the comparison.
Which relocates the question that actually determines whether any of this works. Not how good is the tag, but who holds the register, is it complete, is it funded for the product’s whole life, and what happens to a genuine item whose entry is missing.
And we now have a number for that. In the most mature verification system ever built, 26 per cent of packs are not checked out of the register when they are dispensed. Not an estimate of fraud: a measurement of how much of the record is simply not written. In Kenya the register’s deadline lapsed in 2023 and was extended informally with no replacement date. In Maharashtra the reference library came with the instrument and is maintainable by whoever controls it. For a cryptographic chip, a record deleted or expired produces no authentication signal at all. In Europe, a quarter of the entries that should close never close.
The hardest problem in product verification is not cryptographic. It is custodial.
What has to exist around it
If the mechanism only answers two questions, the rest of the programme has to answer the others, and Selinko’s list of what surrounds the chip is the most useful public statement of it we have found: verification at each custody handoff rather than only at the consumer, deliberate design of what makes someone scan at all, a detection-to-response pipeline so that a failed scan reaches legal and takedown rather than a dashboard, counterfeit analytics, and explicit territory logic so diversion is distinguishable from counterfeiting.
Their summary judgment is the one to quote at any vendor, us included: “Detection without response is surveillance, not protection.” And: “The brands that deploy the technology without the surrounding programme have a chip and a dashboard. The counterfeiting problem looks the same before and after deployment.”
They also note that the integration, workflow, dashboard, training and response costs typically outweigh the tag itself, which is the opposite of how this category is usually priced in a pitch.
In fairness, and a note on the source
Two things about relying on a competitor’s material.
The first is that they published it, and most of this industry does not. A vendor writing down the five ways its own product fails to solve the customer’s problem is doing something unusual, and the fact that we found the clearest articulation of our category’s limits on a rival’s blog is worth saying out loud.
The second is that their two pages do not entirely agree with each other, which is ordinary and worth noting rather than scoring. One says a tamper-integrated chip means removal causes visible damage and that cloning is economically unviable; the other says a chip can be peeled off intact and that transplant is not categorically impossible. One calls the mechanism challenge-response; the other describes a counter-based SUN code and never uses the term, which is the more accurate description. That is the usual gap between a marketing page and an engineering page, and both of ours have it too.
There is a third thing, and it is about an institution rather than a vendor. EUIPO’s technology guide page on physically unclonable functions explains what the technology is, what it costs relative to the tag it sits on, and which product sizes it suits. It carries no section on disadvantages or limitations at all. That is the European Union’s own anti-counterfeiting technology guide describing an authentication technology with nothing listed on the other side of the ledger, and buyers read these guides precisely because they expect them to be more balanced than a vendor’s site.
What we are not saying
We are not saying verification does not work. It does the thing it does, which no printed identifier does, and the first four of the five limits above are addressable with design and money rather than with new physics.
We are not saying the European standards are deficient. They govern carriers and data, they say so, and a signed passport with an audit trail is a real improvement on an unsigned spreadsheet. Expecting a data standard to establish a physical fact about an object is a category error, and our own industry encourages it.
We are not claiming the EN 18246 position as final. It was published in September 2026 and is not yet cited in the Official Journal, our account of what it requires comes from secondary summaries rather than the standard’s text, and we have not read the clauses.
We are not saying the European medicines scheme failed. It is a genuine achievement, it caught falsified Ozempic inside the legal chain in 2023, and eleven confirmed cases may reflect a clean legal supply chain rather than a system missing things. We are saying that the public evidence from the largest deployment in existence shows what the mechanism is: a check on a record, performing in proportion to how complete that record is, in an environment where roughly three quarters of its alerts are technical.
We are not saying physically unclonable functions are the answer and the rest of the category is obsolete. They answer limit two, which nothing else does, and they do not touch limits one, three, four or five. The paper-surface literature is explicit that nobody has thoroughly tested the metrics on a deployable system, enrolment is sensitive to alignment, the substrate is easy to destroy, and distinguishing ordinary wear from deliberate attack is unexplored. A technology with one decisive advantage and an untested deployment record is a thing to watch closely, not a thing to buy on a slide.
And we are not saying our own product escapes any of this. It does not. Items one through four apply to us exactly as written, item five is outside what any identity layer can do, the custodial problem applies to our backend exactly as it applies to Kenya’s register, and anybody selling you a tag as a solution to counterfeiting rather than as one layer of a programme is selling you a chip and a dashboard.
Who meets this problem
The brand protection lead whose scan dashboard looks healthy because the 90 per cent of units nobody scanned generate no failures.
The buyer comparing three vendors on chip security, which is the one dimension on which they barely differ, while the backend, the personalisation and the response pipeline are where deployments actually fail.
The hospital pharmacist for whom items two and five are the same shift, and who needs two different instruments to cover them.
The compliance manager told that a digital product passport will prove authenticity, reading eight standards that do not mention the physical object.
The procurement officer reading EUIPO’s technology guide, which explains how a physically unclonable function works and lists nothing it fails to do.
And the person holding the thing, who is in the 85 to 95 per cent and will never tap it.
If you are one of these people
If you are buying verification. Ask what proportion of units are expected to be scanned, who scans them, and what happens in the hour after a failure. Then ask what the programme costs excluding tags. The answers to those three questions predict the outcome better than any chip datasheet.
If you are deploying it. Move the check off the consumer. A verification at each custody handoff is worth more than a consumer-facing scan nobody performs, because it is a check someone is paid to do.
If you are writing a national scheme or a standard. Say which question you are answering. The EN family is admirably clear that it governs data; the political summaries of it are not, and the gap between those two is where buyers form false expectations.
If you are evaluating an intrinsic approach. Ask for enrolment throughput and the failure rate at enrolment, not the equal error rate. The published figures for norm-map accuracy are extraordinary and the published figures for deployed systems do not exist, and the gap between those two facts is where a pilot will live or die.
If you sell this, as we do. The five limits belong in the sales material, not in a rebuttal held back for the technical call. A category that oversells gets regulated on the basis of what it promised.
The three sentences to keep
A correctly deployed cryptographic tag proves that a response came from a chip holding the brand’s key, and that the tap is new.
Everything else, that someone looked, that the chip is on the right object, that the object is in the right market, that the record still exists, that the contents match the label, and that a copy of the identifier did not get to a scanner first, has to be established some other way.
And whichever mechanism you choose, printed, cryptographic, chemical, state-issued or intrinsic to the material, the answer it gives you is a comparison against a record somebody is maintaining. Choose the technology on what attack it makes expensive. Then spend the rest of your attention on who keeps the register, because that is the part that fails quietly and the part nobody demonstrates.
Aeroz, Making Authenticity Checkable. Visit aeroz.io to learn more & get in contact with our team via [email protected].
© 2026 Aeroz. All rights reserved.