How Grey Tracking Actually Works: Turning Verification Scans Into a Diversion Map

Grey market goods are authentic products sold outside their authorised distribution channels. They carry the real trademark, pass every quality check, and sit on a shelf that looks perfectly legitimate. That is exactly why they are difficult to detect, and why they cause so much damage.

The drivers behind grey market diversion are structural:

• Price arbitrage. Regional pricing strategies create margin gaps that unauthorised resellers exploit. A product priced for the Indian domestic market reappears in the EU at a discount that undercuts the authorised distributor.
• Channel leakage. Authorised distributors oversupply secondary buyers, who then resell into restricted territories or channels (e-commerce, duty-free, parallel import markets).
• Warranty and liability exposure. Products sold outside the intended market may lack local regulatory compliance, correct labelling, or valid warranty coverage, creating legal risk for the brand.
• Margin erosion for authorised partners. Retailers who invest in brand-building, training, and after-sales service lose volume to grey sellers who carry none of those costs.
• Brand perception damage. Inconsistent pricing, packaging mismatches, and poor post-sale support in grey channels degrade the brand experience, even when the product itself is flawless.

Unlike counterfeiting, the grey market involves genuine goods. Traditional anti-counterfeit tools that answer a binary question, real or fake, do not solve it. Grey tracking requires a different capability: knowing where and when each unit surfaces, and comparing that to where it was supposed to be.

A diversion map is a data visualisation that plots the gap between a product’s intended distribution path and its actual location as revealed by field scans. Each scan contributes a coordinate: a place, a time, and a product identity. When scans cluster outside authorised territories, the map flags a diversion corridor, not a single incident, but a pattern that points to a specific source, route, or reseller.

The map does not require cooperation from the grey seller. It relies on scans performed by anyone in the chain: consumers verifying authenticity, retailers checking incoming stock, or field auditors running spot checks. Every tap is a data point, whether the person tapping knows they are contributing to the map or not.

The process from tag to diversion alert follows a clear sequence.

1. Serialisation at production. Each unit receives a unique NFC tag, typically based on the NTAG 424 DNA chip (ISO/IEC 14443-A, NFC Forum Type 4). The tag is encoded with a unique identifier linked to a GS1 Digital Link URI carrying a GTIN and serial number. At encoding, the tag is associated with its intended market, distribution channel, and first-sale destination in the brand’s track-and-trace platform.

1. Cryptographic binding. The NTAG 424 DNA chip uses AES-128 encryption and Secure Unique NFC (SUN) messaging. Each time the tag is tapped, it generates a one-time authentication code derived from the chip’s secure key and an incrementing counter. This means the tag’s response is unique to every scan, it cannot be replayed, cloned, or predicted. The product’s digital identity is cryptographically bound to the physical item.

1. Field scan and data capture. A consumer, retailer, or auditor taps the tag with a smartphone. iPhones from the XS/XR onward read NFC tags in the background, no app required. Android devices read natively with the screen on. The scan transmits the tag’s authentication code, along with metadata: GPS coordinates (when available), timestamp, device language, and IP-derived geolocation as a fallback.

1. Server-side verification and location matching. The cloud platform validates the SUN authentication code, confirming the tag (and therefore the product) is genuine. It then compares the scan location against the product’s assigned distribution territory. If the scan falls within the authorised zone, it is logged as a routine verification. If it falls outside, it is flagged as a potential diversion event.

1. Pattern aggregation. A single out-of-territory scan could be a travelling consumer. The system looks for clusters: multiple units from the same production batch or same distributor surfacing in the same unauthorised region within a defined time window. These clusters form diversion corridors on the map.

1. Alert and investigation trigger. When a corridor exceeds a configurable threshold, say, five units from the same batch scanned in an unauthorised market within 30 days, the platform generates an alert. The brand’s commercial or legal team can then trace backward through the supply chain to identify the point of leakage: which distributor received that batch, when, and in what quantity.

The key distinction: grey tracking does not require catching a diverted product at a border or in a warehouse. It works passively, accumulating evidence from routine scans that consumers and retailers perform for their own reasons, authentication, warranty registration, or product information.

Both NFC and serialised QR codes can carry a unique product identifier. Both can capture scan location data. The difference lies in security, data quality, and resistance to manipulation.

Capability	NFC (NTAG 424 DNA)	Serialised QR code
Clonability	Cryptographic SUN response unique per tap; chip cannot be cloned	Code can be photographed, reprinted, or shared as an image
Scan authenticity	Each scan is cryptographically verified as coming from the original chip	No inherent way to distinguish a scan of the original from a scan of a copy
Location data reliability	Scan requires physical proximity (1-4 cm); location data reflects where the physical item actually is	Code can be scanned from a photo taken elsewhere; location data may reflect where the image is, not where the product is
Tampering evidence	TagTamper variants detect if a closure has been broken (wire-based tamper loop)	No tamper detection inherent to the code
Consumer friction	Tap-to-verify, no app required (iOS XS+, Android)	Point camera, may require app or redirect
Marginal unit cost	Published converter prices for NTAG 424 DNA-class labels cluster around $0.45-0.65/unit at five-figure volumes; on-metal variants +7-30%; 50k+ quote-only (public catalogues, 2026)	Printed QR adds near-zero marginal print cost; the real cost is serialisation and platform (industry sources, 2026)
Scan rate (typical)	Higher for products where authentication matters to the end consumer (spirits, luxury, collectibles)	Higher for commodity products where information access is the primary use case

For grey tracking specifically, the critical differentiator is location data integrity. A serialised QR code can tell a brand that someone scanned a given unit, but it cannot guarantee that the scan happened where the product physically sits. An NFC scan, by contrast, requires the phone to be within centimetres of the chip. When a tap registers in Seoul, the product is in Seoul.

NFC is not always the right tool. There are scenarios where serialised QR codes serve distribution monitoring adequately or where NFC is impractical:

• Very high volumes, low unit value. For products priced under a few euros per unit, mass-market FMCG, for instance, the $0.45-0.65 cost of a secure NFC tag may exceed the margin available for anti-diversion measures. A serialised QR with platform-side analytics can still flag suspicious scan patterns, even without cryptographic proof.
• No secondary market risk. If the product category has minimal resale activity, no collectors, no premium aftermarket, the additional security of NFC may not justify the cost.
• Extreme production speeds. Some packaging lines run at speeds that make NFC inlay placement or encoding a bottleneck. QR serialisation can be integrated into existing print processes with minimal mechanical change.
• Regulatory compliance as primary driver. The EU Digital Product Passport under ESPR (Regulation (EU) 2024/1781) is carrier-neutral, but GS1 Digital Link QR is emerging as the de facto visible data carrier for DPP compliance. When the primary objective is regulatory conformity rather than anti-diversion, QR may fulfil the requirement at lower cost. NFC then serves as the trust layer, for authentication and grey tracking, alongside the visible QR carrier.

The strongest deployments pair both: QR for broad information access and regulatory compliance, NFC for authentication and high-integrity location data.

Wine and spirits

Diversion is endemic in spirits. A bottle allocated to domestic retail in one market reappears in travel retail or e-commerce in another. NFC closures, tags embedded in the cap or collar, serve double duty: tamper evidence (detecting if the bottle has been opened) and location tracking on every consumer scan. High unit values (premium and single malt categories) justify the tag cost, and collectors actively scan for provenance verification, generating dense location data.

Luxury watches and jewellery

Authorised distribution is tightly controlled, and grey market activity directly undermines retail partners who invest in brand experience. NFC tags embedded in the caseback or strap, using on-metal variants with a ferrite layer to prevent detuning, allow each piece to be verified and located. Warranty activation scans generate a first-owner location record; subsequent scans during resale or service reveal if the piece has migrated outside its intended market.

Cosmetics and fragrance

Product diversion in fragrance often follows promotional or travel-retail overstock paths. NFC tags on premium lines track where units surface post-sale. The challenge is packaging integration, fragrance packaging is compact and often includes metallised elements. On-metal tag variants and careful antenna placement address detuning, though standard tags work on non-metallic packaging (cartons, cellophane wraps) without modification.

Leather goods and fashion

The EU DPP will require product-level data carriers for textiles and apparel, with delegated acts indicatively expected in 2027 and enforcement following 18 months or more after adoption. Brands deploying NFC now for authentication and grey tracking will already have the serialisation infrastructure in place when DPP obligations take effect. Leather goods carry high resale values, making diversion economically attractive and grey tracking operationally justified.

Cigars

Premium cigars are sold through tightly controlled distribution networks, often with regional exclusives. NFC tags embedded in the band or box seal allow collectors and retailers to verify both authenticity and intended market. The relatively low production volumes and high unit values make NFC tagging cost-effective per unit.

NFC scan location data comes from two sources: the device’s GPS (when the user grants location permission) and IP-based geolocation as a fallback. GPS accuracy is typically within 5-15 metres outdoors. IP geolocation is coarser, reliable at city or region level, which is sufficient for grey market detection where the question is “Is this product in the right country?” rather than “Is it on the right shelf?”

Read reliability across NFC deployments reaches 99%, meaning virtually every legitimate scan attempt results in a successful data capture. This consistency is what makes aggregation viable: a 99% read rate across thousands of units generates a dense, reliable dataset for pattern detection.

Standard NFC tags detune on metal surfaces, the metal interferes with the antenna’s electromagnetic field, reducing or eliminating read range. On-metal tags incorporate a ferrite shielding layer between the chip and the metal surface, restoring full read performance. These variants add 7-30% to the unit cost.

Liquids (wine, spirits, cosmetics) do not block NFC signals in the same way metal does, but bottle shapes and cap materials can affect read distance. Tag placement on the cap, neck label, or outer packaging, rather than directly on the glass behind liquid, ensures consistent performance.