Why a Higher One‑Code Scan Rate Can Backfire: How Fraudsters Drain Marketing Budgets

In the highly competitive fast‑moving consumer goods market, especially beverages, the one‑code‑one‑item (unique QR code printed on caps) has become the mainstream tool for promotional activities. Brands expect the scan to stimulate purchase, collect granular consumer data, and build long‑term interaction, but the actual consumer scan rate is usually below 30%.

Professional fraud groups, known as “羊毛党”, obtain large numbers of uncapped bottles through waste‑recycling stations, internal leaks, or theft of code packages. They then use automated scripts to batch‑scan and redeem rewards, creating a massive amount of non‑consumer scan data that inflates the apparent scan rate far beyond the level that would be generated by genuine purchases.

This behavior turns the promotional budget into ineffective cost. For example, a campaign planning 1,000,000 bottles with a 10% win rate expects 100,000 prizes. If only 30% of bottles are truly scanned by consumers, about 30,000 prizes are legitimate, but fraudsters may add another 50,000 redemptions, forcing the brand to pay for prizes that have no corresponding sales uplift.

The article debunks three common misconceptions:

Misconception 1: Fixed win rate guarantees controllable cost – false because redemption volume depends on actual scans, not just the preset win rate.

Misconception 2: An opened cap equals a sale – false since caps can be opened without purchase, allowing fraudsters to harvest codes without any real transaction.

Misconception 3: A promotion only needs to break even financially – false because strategic goals also include sales lift, valuable data collection, and brand‑consumer relationship building.

The sources of stolen caps are twofold:

Internal threats: Employees may leak or steal unactivated QR code packages, or production‑line breaches may expose codes.

External black‑market chain: Collected caps flow to illegal resale platforms, where they are batch‑scanned with scripts, draining marketing incentives without delivering real consumer value.

To defend against these threats, the article proposes a full‑link protection framework:

Source control: Use code‑generation services that comply with GB/T19425‑2003 standards, adopt financial‑grade algorithms, and employ three‑layer empty‑code assignment to prevent code leakage before activation.

Activity rule design: Enforce real‑identity binding (e.g., mobile‑number verification), set strict limits per device/IP, apply geofencing to restrict scans to target regions, and introduce simple anti‑automation challenges for high‑value rewards.

Technical risk control: Deploy a real‑time risk engine that aggregates user, device, behavior, and environmental signals; build multi‑dimensional profiles to detect script‑like scan patterns; implement tiered response (normal, suspicious, high‑risk) and dynamic reward adjustment based on risk scores.

Internal governance and collaboration: Apply least‑privilege access, maintain immutable audit logs, conduct regular security awareness training, and establish cross‑department coordination among marketing, sales, production, IT, risk, and legal teams.

Only by ensuring that each prize reaches a genuine consumer and that each scan reflects real consumption can one‑code technology fulfill its promise as a driver of business growth rather than a tool for black‑market exploitation.