How a tamper-evident NFC seal makes refilling visible and scan records expose diversion

01 / FIELD NOTE

Keep the decision tied to the operating context.

The category of fraud that matters for a premium spirit is not a counterfeit label on a fake bottle; it is the refill, where a genuine empty bottle is re-filled with a substitute liquid, and the diversion, where a genuine bottle leaves its intended market. The two are opposite in one sense and similar in another — the bottle is real in both cases. What a printed mark cannot do is distinguish a bottle that was filled once at the distillery from a bottle that was opened and re-filled, because the mark is the same. The change that RFID makes is that the evidence moves into a state that is physically altered when the bottle is opened.

A tamper-evident seal works by irreversible damage. A tag in the closure or the cap seal is constructed so that opening the bottle breaks the antenna structure; the tag does not fail silently but changes state to "opened", and that state is read at the next interrogation. The refill scenario is closed at its root because the act of refilling requires opening, and opening is exactly the event the tag records. The uniqueness of the identifier is the second half: the seal tells you this bottle and only this bottle, so a cap swapped onto a different bottle is a cap whose own record does not match.

The seal can hide in the packaging. A tag embedded behind the main label is invisible, and the person contemplating a fraud does not know where the security element sits; attempts to remove the label damage the tag. This is the anti-transfer half of the design: the binding between tag and bottle survives the bottle's life, and a would-be re-user has to choose between destroying the label or leaving the evidence. Pair the embedded label with the breakable seal and the two placement strategies cover the two ways a bottle changes hands fraudulently.

The checkpoint scan turns the bottle's story into a chain of custody. Each bottle is logged at the distillery with a birth record — its identifier, its fill, its intended destination — and each subsequent scan at warehouse, distributor, retail or customs appends a step to that record. A bottle that appears in the system without a birth record is immediately anomalous, because every genuine unit enters with one. The chain is built out of reads that already happen in the flow of trade; the addition is that each read is anchored to an identifier that cannot be printed over.

Diversion needs a different mechanism, because the bottle is genuine and its record is in order. What diversion leaves behind is location history: a unit meant for one market appears, at scan, in another. The tag's record carries the intended destination from the birth record, and the scan trail carries where the unit actually travelled; the mismatch is the divergence. For a brand the value is attribution — the scan data says which distributor moved which units where, which turns a market anomaly into an accountable fact rather than a suspicion.

The same tag interaction keeps working at the other end of the chain. A consumer tap verifies the bottle and its open-status in the act of buying; a customs scan reads the same field in the act of importing; a brand operator reads the aggregate in the warehouse system. One identity, one record, many read points, each adding a dated step. The mechanism is not a new device on the shelf — it is a field on an existing inventory identity that was previously unreadable.

The honest boundary is that the seal proves open/closed state and the record proves movement; neither alone proves the contents. A bottle whose seal is intact and whose record is consistent still contains whatever it contains; the seal asserts only that it was not opened since it was sealed, which is exactly the fact a refill attack has to falsify. The two mechanisms compose into a defensible position: the refill is caught at the moment of opening, and the diversion is caught at the first scan after it moves off its intended path. Neither stops a determined fraud at the distillery floor; both make the fraud visible by manufacture.