March 12, 2026
Supply Chain

Why QR Codes and RFID Are Not Enough: The Case for Unclonable Identity

Table of Contents

When a counterfeit integrated circuit ends up in a nuclear submarine — as it did in a case that led to a federal conviction — the failure wasn't in the inspection process, the procurement policy, or the supplier relationship. The failure was in the underlying assumption that a label can be trusted.

That assumption runs through almost every authentication technology in widespread use today. QR codes, RFID tags, barcodes, holograms — each of these technologies was designed to encode or carry identity information. None of them are identity. And in an adversarial environment, that distinction is the difference between a supply chain you can trust and one you merely believe you can trust.

The Problem With "Good Enough"

For most of their history, supply chains operated on the basis of trust between known parties. A manufacturer sourced from a vetted supplier. A distributor carried only certified product. The paperwork matched the parts because the incentive to falsify it was low and the risk of getting caught was high.

That model is under sustained pressure. Global supply chains now move through dozens of hands across multiple continents before a component reaches final assembly. The economics of counterfeiting — particularly in high-value sectors like aerospace, defense, and secure electronics — have become attractive enough to draw sophisticated actors. And the technologies most organizations rely on to authenticate parts were designed for a different world.

QR Codes: Identity by Reference, Not by Proof

A QR code is a pointer. It encodes a URL or identifier that, when scanned, retrieves information from a database. That information might confirm that a product with this ID passed quality checks, holds a certain certification, or originated from a specific supplier.

What it cannot confirm is that the physical object in your hand is the same object the database entry describes.

Anyone with a printer and access to a product's packaging can reproduce a QR code. The code is not bound to the object — it is affixed to it. Sophisticated counterfeiters don't need to break the authentication system. They just need to copy the label.

RFID: Readable, Writable, and Reproducible

RFID offers real advantages for inventory management and logistics — long-range reads, no line-of-sight requirement, high-volume throughput. But RFID chips are commercially available, writable, and cloneable with off-the-shelf equipment.

A tag can be removed from an authentic part and reattached to a counterfeit. The chip's identifier can be read and written to a new tag. In high-stakes applications, RFID provides tracking, not authentication. The two are not the same thing.

Holograms and Security Labels: Security Theater at Scale

Holographic seals and tamper-evident labels were meaningful deterrents when the technology to reproduce them was expensive and rare. That is no longer the case. Industrial-grade hologram replication equipment is accessible, and the visual complexity that once made holograms trustworthy now provides little meaningful resistance to a determined counterfeiter.

More fundamentally, all label-based approaches share the same structural weakness: the security feature travels separately from the object. Compromise the label — copy it, move it, replicate it — and the authentication system fails regardless of how sophisticated the label itself is.

What "Unclonable" Actually Means

The concept of an unclonable identity is not a marketing claim — it has a precise technical meaning. An identity is unclonable when it is physically impossible to reproduce, not merely difficult or expensive.

This distinction matters because "difficult to copy" is a race between defenders and attackers. Attackers have time, resources, and economic incentive. Over long enough time horizons, "difficult" becomes "achievable." Physically impossible does not become achievable. It remains impossible.

DUST Identity's approach grounds identity in the quantum properties of nanoscale diamonds. When diamond dust is applied to a surface, thousands of microscopic crystals settle in a configuration that is random, three-dimensional, and impossible to reverse-engineer. The resulting pattern — readable by optical scanner — is unique to that specific object, in the same way a fingerprint is unique to a specific person.

Critically, this identity is not on the object. It is the object. There is no label to remove, no chip to clone, no database entry to spoof. The physical fingerprint exists whether or not anyone is looking at it, and it cannot be transferred to another object.

Where Traditional Technologies Fail in Practice

Aerospace and Defense

In defense procurement, counterfeit parts don't just represent financial loss — they represent mission risk. Electronic components that have been remarked, recycled, or fabricated to specification but manufactured with substandard materials may pass visual inspection and basic electrical testing while failing under operational stress.

DFARS 252.246-7007 requires defense contractors to implement and maintain risk-based counterfeit avoidance programs and to flow those requirements to all subcontractors. Compliance creates demand for traceability — but traceability built on cloneable tags creates a documented trail that is, itself, falsifiable.

When a part's identity is anchored to a physical fingerprint that cannot be reproduced, the chain of custody becomes genuinely trustworthy rather than procedurally documented.

Secure Electronics

Semiconductor supply chains are long, globally distributed, and subject to periodic shortages that push procurement teams toward secondary markets. Secondary markets are where counterfeit risk is highest. A component that has been remarked with a different grade, date code, or manufacturer designation is indistinguishable from a genuine part by any authentication method that depends on what is written on the package.

Unclonable identity applied at the point of manufacture creates a verifiable link between a specific physical component and its complete provenance record — test data, certification history, chain of custody — that cannot be fabricated after the fact.

Premium Goods and Collectibles

The economics of counterfeiting luxury goods and authenticated memorabilia are straightforward: the gap between the cost of a fake and the price of the real thing is large enough to sustain sophisticated operations. Authentication methods based on certificates of authenticity, holographic seals, or database-registered serial numbers are routinely defeated because all of those features can be reproduced.

Physical identity that is bound to the object itself changes the authentication calculus entirely. A collector, insurer, or resale marketplace can verify not just that a document claims an item is authentic, but that the item's physical fingerprint matches the record established at the point of origin.

The Right Question to Ask About Any Authentication Technology

When evaluating an authentication solution, the question most organizations ask is: How hard is this to fake?

The better question is: Is it possible to fake this at all?

For QR codes, RFID, holograms, and most label-based approaches, the answer to the better question is yes — with enough effort, resources, or access to the right equipment. The authentication provides a friction cost, not a ceiling.

For identity grounded in unclonable physical properties, the answer is no. The effort required is not merely high — it is physically prohibited by the properties of the material itself.

Supply chains for critical components, high-value goods, and authenticated objects are increasingly adversarial environments. The authentication technologies that serve them well need to be built for that reality.

Request a Demo
See how our solution can transform your workflow. Schedule a personalized demo with our team.
Our Story