The latest QR code service from WeChat contains a critical risk

Interactive, but not secure

“Mobile first”: China is the land of smartphones and QR codes. Chinese customers are used to using QR codes on products to take part in competitions, obtain product information or verify a product’s authenticity. So it stands to reason that WeChat is now offering a QR code service for business customers. It also fits with the strategy of its parent company, Tencent, who wants to improve its offerings for B2B customers. With the new service from WeChat, each branded product is equipped with a unique QR code. According to WeChat, brands can use the “one object, one code" system to selectively control marketing measures, attract users to the brand account, combat counterfeiting and gather important data on customer behaviour. But there’s a catch:

Printed QR codes can easily be copied and used by counterfeiters

Simple printed codes such as QR codes are not protected against reproduction. In a country such as China in particular, where professional counterfeiters are a major problem, simple printed codes are not reliable. This can have serious consequences for companies that use this system: Counterfeits can be furnished with the copied QR code and, undetected, be sold as originals. Competitions and winnings payouts can be manipulated. And these are just two examples. WeChat also uses the data collected through this system in particular for advertising. And it’s true – data from all the above measures enables valuable conclusions to be drawn about customer behaviour. These in turn form the basis for business decisions. However, if the QR codes have been copied by counterfeiters, this data is distorted. The decisions taken are without any foundation and can do serious damage to a brand’s business development.

Protecting QR codes from counterfeiters with physical security features

These risks could easily be eliminated by adding a physical level of security to the printed codes. Each QR code would be linked to a tamper-proof security feature. When users scan a QR code, they are taken to an intuitive online authentication process. Within a few seconds, users verify the authenticity of the product using the security feature and are then taken to the desired offers, e.g. a competition. This combination of a QR code and security feature acts as a kind of “security door” and ensures that all the measures planned by the brand are protected from third parties. It can only be hoped that WeChat will recognise the existing security risk and fix it.

Sources

Technode