A defining opportunity for clarity from GS1

Coding standards group GS1 will be holding its General Assembly from May 19 to 23, 2025 [1]. The event will bring together its senior management and leaders from member organisations worldwide. And for the first time, GS1 has selected India as the venue — an excellent choice because of its long-standing work there to help rid the country of counterfeit medicines.

Here, I take up two propositions that respectively relate to India’s unfolding failure of a recently installed QR coding programme and the withdrawal of its earlier Track & Trace system, both rolled out to protect against counterfeit medicines. Each proposition is grounded in a set of assertions that are supported by extant evidence from published articles or publicly available documents.

A set of questions is then posed to understand GS1’s current position on the appropriateness of QR coding and supply chain traceability for use as systems to arrest counterfeit medicines.

A) QR coding is not safe for use in anti-counterfeiting systems

India’s Ministry of Health and Family Affairs launched an anti-counterfeiting programme in 2023 to tackle the presence of fake medicines across the country [2]. The programme requires mandatory participation by manufacturers or marketers of the top three hundred drugs sold in India. A key part of the system requires drug packages be affixed with QR codes, which represent the fundamental data carrier for the entire programme. A scan of the code by an inspector or consumer should yield key information about the drug and its maker.

Assertions

It is widely accepted that QR codes are vulnerable to misuse or compromise. 

Respected cyber security agencies and experts have issued warnings about using QR codes due to their vulnerability to multiple attack vectors [3-6]. Major federal agencies in the United States, such as the FBI and FTC, have issued public warnings on the danger of QR codes [7-9]. Varied influential voices from the public forum have also weighed in with their views on the dangers of using QR codes [10-12].

The security problems associated with QR codes are now coming to light in India. 

Counterfeit versions of an anti-hypertensive drug (Telma AM) with fake QR codes started appearing in early 2025 [13,14]. There then followed discoveries of fake QR codes on other products across India, such as an anti-clotting drug (Thrombophob) [15] and an anti-vertigo medicine (Vertin) [16]. Then in a major bust of a distribution facility by authorities in Gujarat state, large quantities of medicines with fake QR codes were discovered on what turned out to be an anti-epileptic drug (Levipil) made by India’s largest manufacturer [17,18].

Unlike most cases of QR codes being replicated from genuine versions in the market, the latter case appears to be a sophisticated operation where large numbers of genuine serial numbers were somehow procured by the criminal entities and placed into QR codes on fake versions of the drug [19]. This in turn produced the illusion of authenticity upon scanning a counterfeit product, with the false message “This is a Genuine Pack” being returned [20].

An analysis of India’s QR coding programme revealed how the open nature of the codes can lead to multiple ways of being compromised and placed on fake drugs [21]. Collectively, these discussions and discoveries affirm the general view of QR codes’ vulnerabilities [22-25] and have led to the question of whether India’s coding programme is fit for use [26-28].

GS1 continues to promote use of QR codes in anti-counterfeiting systems. 

A new web-based standard has been defined by GS1, known as Digital Link, in which product information can be retrieved by way of a QR code that is structured around GS1’s proprietary syntax [29]. Various GS1 member organisations now promote the QR-code Digital Link solution as a way to receive online information [30-32].

GS1 India claims that it is the only authorised source for barcodes in the country [33]. Nearly two-thirds of drug companies in India that were surveyed for compliance with the Health Ministry’s coding mandate showed adoption of GS1’s Digital Link syntax [34; Ref 10 therein]. Three out of the four recent counterfeiting cases in India with fake QR codes discussed above (Levipil, Telma, Vertin) used the GS1 Digital Link syntax [35].

Questions

Will GS1 continue to promote use of QR codes to combat drug counterfeiting in light of the above evidence?

If so, what would be the justification for use of a system that can be easily compromised such that fake QR codes are now regularly appearing on counterfeit medicines across India?

B) Product traceability is not appropriate for use in anti-counterfeiting systems

The second proposition in this article concerns the adoption of supply chain traceability (Track & Trace) as a means of thwarting counterfeiters. India’s Ministry of Commerce introduced an anti-counterfeiting programme in 2011 based on traceability to protect exported drugs, with the specific requirement to obtain and incorporate GS1 barcodes at different package levels and following its standards [36]. The mandate was updated in 2015 to additionally include digital integration of nested package structures known as aggregation [37].

Assertions

Cost and complexity of Track & Trace programmes lead to major delays.

The cost of deploying a full end-to-end traceability programme has been a major concern to the pharmaceutical industry, especially among the smaller companies [38,39]. The cost arises due to complexity of the deployment process across five operational levels that require acquisition of industrial printing equipment, image capture technologies and IT systems [40-42]. A complete traceability programme can take several years for full deployment, often leading to concerns about eventual preparedness [43]. The program’s complexity and other factors thus produce significant implementation delays, as happened with the United States drug traceability programme, which has not yet been fully launched twelve years after it became law [44-46].

India had to abandon its traceability programme for exported drugs.

The Indian export drug traceability programme faced hurdles and delays due to problems with the central portal [47], coding challenges [48] and difficulties with package aggregation whose deadline was repeatedly delayed [49]. Fourteen years after the export drug mandate was announced, the Indian government withdrew the programme earlier this year [50,51].

It has been argued that the Indian experience shows drug traceability is not a suitable option for many developing countries, especially when there is need to quickly implement an anti-counterfeiting programme [52; page 10].

GS1 continues to promote drug traceability as an anti-counterfeiting solution. 

In addition to developing Track & Trace standards, GS1 is active in government advocacy [53] and the business of traceability [54-56]. GS1 had an early programme to generally promote adoption of traceability [57], with more recent efforts that explicitly ties it to being an anti-counterfeiting solution [58,59]. Despite the failure of India’s traceability programme over more than a decade, GS1 continued to advance its use in other developing markets as a way to stop counterfeit drugs, such as in Kenya and Zambia [60,61].

Questions

Will GS1 continue to promote use of traceability (Track & Trace) to combat drug counterfeiting in light of the above evidence?

Does GS1 believe there is a conflict of interest between developing traceability standards and then pursuing government advocacy for its adoption in light of the business benefits it can later derive?

The upcoming General Assembly represents an opportune moment for GS1 to have an open discussion on the above two anti-counterfeiting approaches and the specific questions surrounding them. Our shared agenda is to protect all people from harm arising out of counterfeit medicines and to find the best way to offer that protection in an effective, enduring and economical manner.

The twin approaches that GS1 has advocated in the past have failed however, and demonstrably so, as discussed above. The fundamental question now is whether GS1 will still continue to promote QR codes and drug traceability in developing countries as being effective methods for anti-counterfeiting purposes.

If GS1 continues to believe that both systems provide safe and effective protection to consumers, then it should be able to defend that position in a scholarly and rigorous manner through publication of a white paper or similar so that its arguments can be subjected to open peer review and comment.

 

Express Pharma has approached GS1 India for their point of view. We will feature this once we receive it

 

References 

1. https://ga.gs1.org
2. https://egazette.gov.in/WriteReadData/2022/240392.pdf
3. https://www.cyber.gc.ca/en/guidance/security-considerations-qr-codes-itsap00141
4. https://www.ncsc.gov.uk/blog-post/qr-codes-whats-real-risk
5. https://www.kaspersky.com/resource-center/definitions/what-is-a-qr-code-how-to-scan
6. https://cyber-center.org/qr-codes/
7. ttps://www.ic3.gov/PSA/2022/PSA220118
8. https://threatpost.com/fbi-malicious-qr-codes/177902/
9. https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information
10. https://www.forbes.com/councils/forbestechcouncil/2020/06/01/i-dont-scan-qr-codes-and-neither-should-you/
11. https://www.theguardian.com/commentisfree/article/2024/jun/08/qr-code-scammers-phishing-quick-response-cybersecurity
12. https://news.va.gov/136377/think-twice-before-you-scan-qr-codes/
13. https://timesofindia.indiatimes.com/city/kolkata/spurious-meds-worth-over1-crore-in-open-market/articleshow/118460970.cms
14. https://indianexpress.com/article/cities/kolkata/bengal-chemists-association-flag-47-per-cent-rise-fake-medicines-post-covid-9875371/
15. https://indianexpress.com/article/cities/delhi/counterfeit-medicines-worth-over-rs-2-5-lakh-seized-from-delhi-wholesaler-9944475/
16. https://drugscontrol.org/news-detail.php?newsid=42246
17. https://www.securingindustry.com/pharmaceuticals/gujarat-hit-by-wave-of-falsified-qr-codes-on-medicines/s40/a16946/
18. https://www.expresspharma.in/a-troubling-new-development-in-indias-qr-code-saga/
19. ibid.
20. https://www.expresspharma.in/sun-pharma-must-immediately-declare-a-voluntary-recall-of-levipil-500/
21. https://www.securingindustry.com/pharmaceuticals/india-s-drug-qr-coding-programme-anatomy-of-a-debacle/s40/a16877/
22. https://digital.gov/resources/introduction-to-qr-codes/
23. https://www.microsoft.com/en-us/microsoft-365-life-hacks/privacy-and-safety/shady-side-of-qr-codes
24. https://www.aarp.org/money/scams-fraud/qr-codes/
25. https://blog.ssa.gov/protecting-yourself-from-qr-code-fraud/
26. https://www.expresspharma.in/how-counterfeiters-are-breaching-indias-qr-code-system/
27. https://sayacare.in/blogs/can-qr-codes-protect-you-from-fake-medicines
28. https://www.securingindustry.com/pharmaceuticals/seizure-shows-frailties-in-india-s-anti-fake-meds-system/s40/a16865/
29. https://ref.gs1.org/docs/2023/QR-Code_powered-by-GS1-best-practices
30. https://www.gs1belu.org/en/gs1-digital-link
31. https://www.gs1uk.org/standards-services/get-market-ready/qr-codes-powered-by-gs1/gs1-digital-link
32. https://www.gs1us.org/industries-and-insights/standards/gs1-digital-link
33. https://www.gs1india.org/blog/know-all-about-barcode-authentication/
34. https://www.securingindustry.com/pharmaceuticals/india-s-qr-code-programme-part-2-rating-the-drug-makers/s40/a16919/
35. Ibid.
36. https://content.dgft.gov.in/Website/pn5910.pdf
37. https://content.dgft.gov.in/Website/pn1315.pdf
38. https://datacode.co.in/serialization-in-the-pharmaceutical-industry/
39. https://medwinpublishers.com/OAJPR/current-status-and-challenges-of-serialization-in-pharma-industry.pdf
40. https://hello-pharma.com/track-and-trace/l1-to-l5-in-serialization-track-and-trace-levels-of-serialization/#:~:text=This%20layered%20approach%2C%20L1%20to,efficient%20and%20secure%20serialization%20implementation.&text=Function%3A%20This%20level%20centers%20on,or%20even%20laser%20etching%20machines
41. https://www.gep.com/blog/strategy/supply-chain-track-and-trace-benefits
42. https://www.softgroup.eu/2021/03/15/blog-challenges-of-global-track-and-trace-for-pharma-industry-2021/
43. https://www.supplychaindive.com/news/Drug-Supply-Chain-Security-Act-electronic-transfer-deadline/651876/
44. https://nabp.pharmacy/news/blog/regulatory_news/fda-delays-enforcement-of-dscsa-requirements-until-november-2024/
45. https://advis.com/regulatory-updates/dscsa-delay/
46. https://pubmed.ncbi.nlm.nih.gov/34007690/
47. https://www.expresspharma.in/fix-dava-portal-says-industry-to-directorate-general-of-foreign-trade/
48. https://www.expresspharma.in/dgft-delays-barcode-implementation-on-primary-packages-indefinitely/
49. https://www.securingindustry.com/pharmaceuticals/india-extends-aggregation-deadline-for-drug-exports-until-april/s40/a10396/
50. https://pib.gov.in/PressReleseDetailm.aspx?PRID=2098042&reg=3&lang=1
51. https://www.business-standard.com/pti-stories/national/comm-min-withdraws-rule-for-track-trace-system-for-export-of-drug-formulations-125013101423_1.html
52. https://www.saffronmedia.in/eMagazines/CP/2025/CP01052025/index.html
53. https://www.gs1india.org/how-we-engage-with-the-government/
54. https://www.gs1india.org/content/register-for-barcodes/
55. https://www.gs1india.org/blog/pharmaceutical-industry-supply-chain-risk/
56. https://www.gs1india.org/datakart-for-brand-owners/
57. https://www.gs1.org/docs/traceability/GS1_tracebility_what_you_need_to_know.pdf
58. https://www.gs1india.org/blog/why-is-traceability-important-for-consumer-safety/
59. https://gs1indiacontent.blogspot.com/2020/04/gs1-traceability-service-enables.html
60. https://app.box.com/s/qrdz2j8cst5xpuj8b2hf56qlvmg4wb9i
61. https://app.box.com/s/2tj7p0ssqcpz35tfpnntf9u3l754esbe