Spots copied medicine QR codes from scan patterns, for pharma brands
TL;DR India now requires QR codes on its top 300 medicine brands, but a printed code can be photocopied onto a fake pack. Echoscan adds a per-pack serial to the code and watches how each one is scanned, flagging codes seen in two cities at once. Pharma brands pay per million packs.
Since August 2023, the top 300 medicine brands must carry a barcode or QR code that a buyer can scan to check the product[1]. In June 2026 the rule was extended to vaccines, cancer drugs and narcotic drugs, with antimicrobials from July 2028[2]. The code must hold a unique product identification code, batch, dates and licence number[2].
Here's the catch - that proves the code is genuine, not the pack. A counterfeiter who copies one real label gets a code that verifies every single time. CDSCO found 424 spurious or adulterated samples out of 96,713 tested in 2022-23, and the chemists' association estimates up to 15% of medicines in circulation may be fake or substandard[1]. The government has not said how many brands comply[1].
First, the regulatory bit - Echoscan does packaging authentication and supply-chain analytics for drug makers, with no clinical function. It does not test medicine quality. Suspect packs go to the brand and the State Licensing Authority, who run the lab test.
The brand prints a serial number unique to each pack inside, or next to, its mandated QR code. Every scan by a patient, chemist or stockist is logged with time and rough location. The software looks for patterns a real pack cannot make - one serial scanned in Patna and Pune on the same day, a serial scanned 200 times, or batches appearing in districts the brand never shipped to. Chemists get a free receiving app that scans cartons as they arrive, which builds the scan history fast. Flags go to the brand's security team with a map and the pharmacies involved.
The original idea was blockchain provenance, and I've dropped it. India's QR mandate already gives every top brand a code, and a chain would need every distributor to join, which is never going to happen. Watching scans needs nobody's permission except the brand's.
The brand owner pays, meaning brand-protection or supply-chain heads at mid and large drug makers, starting with those in the top 300 list. Price it per million serialised packs plus an analytics fee. I found no public price for comparable services. Chemists use the receiving app free, because it also catches near-expiry and wrong-batch stock.
The QR mandate is three years old and growing to new drug classes from July 2026[2], so brands already pay for printing and code management. Using the scan data is the obvious next step, and a cheaper one. WHO estimates that at least 1 in 10 medicines in low- and middle-income countries is substandard or falsified[3], which keeps the issue in front of regulators.
There's no public figure for pharma brand-protection spending in India. The firmest signals are the mandate itself, which covers 300 brands now and four more drug classes later[2], and CDSCO's own count of 424 spurious samples in a single year[1]. Globally, WHO puts spending on substandard and falsified products at US$30.5 billion a year (about ₹2.95 lakh Cr)[3]. That is the size of the harm, not your market.
Indian anti-counterfeit firms sell authentication and track-and-trace to pharma and other sectors[4]. Another vendor embeds invisible marks in packaging that phones can verify, with pharma among its clients[5]. Both focus on what is printed on the pack. The gap is analysis of the scan history from the mandated codes, plus a chemist-side habit of scanning stock on arrival.
| Difficulty | Moderate (46/100) |
| Starting capital | ₹1–1.8 Cr |
| Time to launch | 9–12 months |
The analytics are the easy bit. The hard bits are getting a drug maker to change its packaging line to print per-pack serials and getting enough scans to see patterns. Without chemist scanning, a copied code may be scanned too rarely to flag. Pharma sales cycles run long too, with quality, packaging and legal teams all wanting a say.
You don't need a drug licence, because Echoscan only flags packs. But you work inside a drug labelling rule, and your codes must fit it.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
This is supply-chain analytics, not drug testing. Don't let a flag be treated as proof a medicine is fake. Only a lab test by the brand or regulator decides that.
Want to work out the AI layer for Echoscan? Talk to Yash →
Here's what can go south -
I think this is worth exploring for a founder with pharma packaging or supply-chain experience and contacts in brand protection. A pure software team will struggle to reach packaging lines. First prove that chemists in one city will scan cartons on receipt every day for a month.
Expect roughly ₹1–1.8 Cr, mostly for engineering, packaging-line pilots with a drug maker and getting chemists to adopt the receiving app.
No drug licence is needed, since you only flag packs. Your serials must fit Schedule H2 of the Drugs Rules, and scan data falls under the DPDP Act.
Yes, WHO says falsified medicines are common in many low- and middle-income countries. Check whether that country already mandates serials and a central database.
The free Echoscan validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for brands and chemists, and 5 assumptions to test. Download the kit →
Thinking about building Echoscan or something close to it? The make-or-break work is winning a first brand willing to change its packaging line, and that's the kind of thing I help founders plan. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.