NFC vs QR vs RFID vs Digital Watermarks: Which Technology Should Brands Use?

The pressure is not hypothetical. It is structural, regulatory, and accelerating.

• Counterfeiting at scale. Global trade in counterfeit and pirated goods reached USD 467 billion in 2021, up to 2.3% of world trade. Within the EU, counterfeits accounted for USD 117 billion, or 4.7% of imports. Clothing, footwear, and leather goods alone represent 62% of seized counterfeits (OECD/EUIPO, Mapping Global Trade in Fakes, 2025).
• Grey market erosion. Products diverted outside authorised distribution channels undercut pricing, damage retailer relationships, and erode brand equity. Detection requires geographic intelligence at the point of consumer interaction, not just at the warehouse.
• Regulatory obligation. The EU Digital Product Passport (DPP), under the Ecodesign for Sustainable Products Regulation (ESPR, Regulation (EU) 2024/1781), requires brands to attach a durable, consumer-scannable data carrier to regulated products. The central EU DPP registry went live on 20 July 2026. Textiles are expected in the first delegated acts indicatively in 2027, with enforcement around 2028-29. Batteries already require a passport from 18 February 2027.
• Post-sale blindness. Most brands lose all visibility the moment a product leaves the store. No first-party data. No engagement channel. No way to distinguish a loyal repeat buyer from a one-time purchaser.

The technology choice determines whether a brand solves one of these problems or all four simultaneously.

NFC (Near Field Communication)

A cryptographic chip embedded in or on the product. Each smartphone tap triggers a challenge-response exchange: the chip generates a unique, one-time cryptographic proof using a secret key stored in protected memory. A monotonic counter prevents replay attacks. The backend validates the response. Security lives inside the chip, not on any visible surface. The dominant chip class for phone-tap authentication is NTAG 424 DNA (ISO/IEC 14443-A, NFC Forum Type 4), which uses AES-128 encryption and SUN (Secure Unique NFC) messaging.

QR Code / GS1 Digital Link

A printed code encoding a URL. In the GS1 Digital Link standard, the URL contains a GTIN and optionally a serial number. Scanned by smartphone camera. When serialised (one unique code per unit) and connected to a backend, it supports authentication workflows. The code itself is static, visible, and copyable. Security depends entirely on backend logic, not on any intrinsic property of the printed mark.

RFID (UHF Gen2)

A passive tag that broadcasts a unique identifier when energised by a reader’s electromagnetic field. UHF Gen2, the dominant supply chain standard, enables bulk scanning: hundreds of tags read simultaneously without line of sight. Most RFID deployments are not cryptographic. The tag broadcasts its EPC identifier to any reader. RFID is a supply chain efficiency and inventory technology. It is not consumer-facing.

Digital Watermark

An invisible, machine-readable identifier embedded into printed packaging artwork. Decoded by a dedicated app or specialist scanner, not by a native smartphone camera. The HolyGrail 2.0 initiative uses watermarks for recycling sortation. As an authentication tool, watermarks share QR’s core limitation: the identifier is in the printed surface and can be replicated by scanning and reprinting.

1. Tag embedding. During manufacture, an NFC chip (typically NTAG 424 DNA) is embedded inside the product or its closure. Each chip carries a unique secret key provisioned at encoding. The tag is invisible to the consumer.
2. Consumer tap. The consumer holds a smartphone near the product. iPhone XS/XR and later read NFC tags in the background without an app. Android phones read natively with the screen on. No camera, no lighting, no deliberate aim required.
3. Cryptographic challenge-response. The chip generates a one-time authentication code using its AES-128 key and increments its monotonic counter. This code is different on every single tap. It cannot be predicted, replayed, or generated without access to the physical chip’s protected memory.
4. Backend validation. The smartphone opens a URL containing the cryptographic response. The brand’s backend (or a platform like SelinkoTrack) validates the code against the expected value, confirms the tap counter has incremented, and logs the event with timestamp, geography, and unit identity.
5. Consumer result. The consumer sees a clear, immediate verdict: authentic or suspect. No ambiguity, no app download, no manual lookup.

The critical distinction: a QR code is a photograph of an address. An NFC chip is a lock that generates a new, unrepeatable key every time someone knocks.

The security gap between NFC and QR is not a matter of degree. It is architectural.

A serialised QR code can be authenticated on the first scan. The backend checks whether the serial number exists and whether it has been scanned before. But the code is visible on the product surface. A counterfeiter who photographs a genuine QR and prints it onto a fake product has a valid identifier. The backend sees a real serial number. It can flag duplicates over time, but only after the counterfeit is already in circulation and consumers have already been deceived.

An NFC chip cannot be photographed. The secret key never leaves the chip’s protected memory. Even if someone reads the chip’s public data, they cannot generate a valid cryptographic response. Each tap produces a unique, unrepeatable proof. Cloning requires physical extraction of the AES-128 key, which is computationally infeasible.

The counterpoint that matters: this level of security is unnecessary for every product. A €3 FMCG item on a supermarket shelf does not face the same threat model as a €300 bottle of single malt. The security architecture should match the risk.

QR wins on three fronts: cost, universality, and infrastructure compatibility.

Cost. A printed QR adds near-zero marginal cost per unit. The real expense is serialisation and the backend platform, not the carrier itself. For high-volume, low-unit-value product lines, NFC’s per-unit cost (published converter prices for NTAG 424 DNA-class labels cluster around $0.45-0.65 at five-figure volumes) is difficult to justify.

Volume and speed. Products manufactured in millions of units per month, where the primary need is serialisation, traceability, and consumer information rather than cryptographic proof, are well served by GS1 Digital Link QR codes. The supply chain already reads barcodes. No new hardware.

DPP compliance carrier. For products where the regulatory requirement is a consumer-scannable data carrier linking to DPP data, GS1 Digital Link QR is emerging as the de facto default. The ESPR is carrier-neutral, but QR satisfies the “consumer-scannable” requirement at minimal cost.

QR is the right sole technology when: unit value is low, secondary market risk is negligible, the product is consumed quickly (no long-term ownership lifecycle), and the primary objective is compliance or supply chain serialisation rather than authentication.

RFID is not a competing authentication technology. It solves a different problem.

Bulk inventory counting. Warehouse receiving without opening cartons. Automated replenishment in retail. Loss prevention at store exits. These are RFID’s domain. A single reader can enumerate hundreds of tags per second without line of sight. No other technology matches this for supply chain throughput.

RFID does not replace NFC or QR for consumer-facing use cases. Consumers do not carry UHF readers. The tag is typically on a hangtag or label, removable from the product. Most deployments do not use cryptographic authentication. RFID tells the supply chain where the product is. It does not tell the consumer whether it is real.

Digital watermarks occupy a niche: recycling sortation and packaging-level identification where no additional label or tag can be applied. The HolyGrail 2.0 initiative demonstrates genuine value for automated waste stream sorting, enabling recycling infrastructure to identify material type and brand from the printed surface itself.

For authentication, watermarks inherit QR’s fundamental weakness: the identifier exists in the printed surface and can be replicated by high-resolution scanning and reprinting. They add a further barrier: decoding requires a dedicated app, not a native smartphone function. Consumer adoption for authentication workflows is limited.

Yes, and for regulated products with authentication needs, the combination is increasingly the reference architecture.

The logic: NFC for trust, QR for compliance. The GS1 Digital Link QR code satisfies the DPP data carrier requirement, is consumer-scannable, and integrates with existing retail and supply chain infrastructure at near-zero marginal cost. The NFC chip provides cryptographic authentication that the QR code cannot. Both can resolve to the same backend, the same product identity, the same consumer experience.

A wine bottle illustrates the pattern. The QR code on the back label carries the GS1 Digital Link URL with GTIN and serial number: regulatory data, provenance, tasting notes, recycling information. The NFC chip in the closure proves the bottle is genuine, detects whether it has been opened, logs every authentication event with timestamp and geography, and enables the brand to identify grey-market diversion in real time.

Neither technology alone covers both requirements. Together, they do.

Published converter prices for NTAG 424 DNA-class labels, the chip family used for phone-tap cryptographic authentication, cluster around $0.45-0.65 per unit at five-figure order volumes. On-metal variants (required for watches, metal closures, audio equipment) add 7-30% due to the ferrite shielding layer. At 50k+ volumes, pricing is quote-only and typically lower.

For comparison, standard non-secure NFC tags (NTAG213-class, suitable for data transfer but not cryptographic authentication) list around €0.19-0.23 at 1-10k units.

The tag cost is one component. Total cost of ownership includes encoding, provisioning, integration into the manufacturing line, and the backend platform. But for a product with a retail price above €30, the authentication cost per unit is a fraction of a percent of revenue, and a fraction of the cost of a single counterfeit reaching market.

The ESPR mandates a durable, consumer-scannable data carrier linked to the product’s DPP data in the central registry. NFC qualifies. So does GS1 Digital Link QR.

In practice, GS1 Digital Link QR is emerging as the default compliance carrier because it is printed, universal, and zero marginal cost. NFC adds a trust layer that the regulation does not strictly require but that authentication, grey-market detection, and post-sale engagement demand.

The pragmatic approach: deploy GS1 Digital Link QR as the DPP carrier. Deploy NFC as the authentication and engagement layer. Both resolve to the same digital identity. Compliance and commercial return from a single infrastructure investment.