QR Code Phishing Product Packaging Security

Quishing — QR codes cloned or altered to redirect a scan to a fake destination — is a documented, rising attack pattern in 2026, and a plain QR code has no way to prove what it points to is genuine; a signed AuthiChain record does.

Why AuthiChain

• Verification checks an Ed25519 signature against the record itself, not just that a URL resolves — a cloned code pointing to fabricated content fails the check
• Offline verification means a scanner is not just trusting whichever server happens to answer at scan time
• A signature proves who issued the record, not that the physical item in hand matches it — stated plainly in protocol/SPEC.md §8

How it works

Issue a unique identifier per unit, anchor its record on-chain for tamper-evidence, and let anyone verify it with a single scan. Plans start at $49/mo.

FAQ

Can a counterfeit copy an AuthiChain QR code and still pass?

The printed code can be copied, but reproducing a valid Ed25519 signature over fabricated content cannot — a cloned code pointing anywhere but the genuine record fails signature verification.

Does this protect against quishing generally?

It stops a cloned code from passing as a genuine AuthiChain record. It does not secure QR codes outside this protocol — any code that is not signed is a separate risk a scanner has to judge on its own.