QR codes can be photographed and reprinted, so they're easy to copy. Basic NFC tags can be read and cloned with a phone app. Secure NFC tags create a new cryptographic response on every tap, which makes cloning impractical. But any tag that can be removed can be moved to a fake. Embedded authentication is built to record that removal.
Key takeaways
- QR codes are for information, not proof.
- Not all NFC is equal. Basic tags clone easily; secure tags don't.
- Cloning isn't the only attack. Moving a genuine tag to a fake beats every tag that can be detached.
Comparison
| QR code | Basic NFC tag | Secure NFC tag | Embedded module | |
|---|---|---|---|---|
| How you check it | Camera scan | Phone tap | Phone tap | Phone tap |
| Can it be copied? | Yes, from a photo | Yes, with a phone app | Impractical | Impractical |
| Can it be moved to a fake? | Yes, reprint it | Yes | Yes, if detachable | Removal is recorded |
| Typical use | Product info, labels | Marketing, links | Digital ID, anti-counterfeit | High-value items where object and record must stay together |
Can QR code authentication be faked?
Yes. A QR code is an image. Photograph it, reprint it on a counterfeit, and every copy opens the same record. QR codes are good at linking to product information. They don't prove the item in your hand is the original.
Can NFC tags be cloned?
Basic NFC tags store readable data. A free phone app can read it and write the same data to a blank tag. Secure tags, such as NXP's NTAG 424 DNA, use AES-128 cryptography and produce a fresh response on each tap. Copying what the tag displays doesn't copy its ability to authenticate.
If secure NFC can't be cloned, why isn't it enough?
Because the tag and the item are separate things. A genuine secure tag sewn into a lining or stuck behind a label can be cut out and put into a fake. It still verifies perfectly. It's just in the wrong product. For low-value goods that risk is small. For a watch or a bag worth thousands, moving a genuine tag can be worth someone's time.
What is embedded authentication?
The credential is built into a structural part of the item during manufacture, such as a watch clasp or a bag's hardware, rather than attached afterwards. Nothing is impossible to remove with enough effort. The point is that removal can't go unnoticed.
On a Shado-registered item, separating the module from the piece records a tamper in the item's history, which shows at every tap. Registered ownership can't be transferred until a review clears it. A tamper never locks the watch or bag. A legitimate strap change or service is cleared through authorised service with the owner's approval in the app, and the event stays in the history.
Frequently asked questions
Is NFC more secure than a QR code?
A secure NFC tag is much harder to copy than a QR code. A basic NFC tag isn't much better than a QR code.
Can I tell if a tag is secure by tapping it?
Not reliably. The checking app has to verify the tag's cryptographic response against the issuer's system.
Does embedded authentication prove the whole watch is genuine?
No. A verified Shado tap confirms the module and its registered history. It can't detect a part replaced elsewhere in the watch, so a watchmaker's inspection still matters.
Does a Shado tap work offline?
No. The tap lets the Shado app read the module, and the app then checks the Shado registry online for the piece's record: its serial, whether a tamper has been recorded, whether it has been reported stolen, and its other registered details. You need the app and an internet connection.
Sources
Next step: see how a Shado tap works.