Chapter Six — Principles and the Culture of Prevention

From Value to the Counterfeiting Iceberg

In many markets, counterfeiting prevention is reduced to familiar advice: “Buy from a reputable source,” “Get an invoice,” “Check the code,” “Be suspicious of low prices.” The advice is not wrong. The problem is that it is often presented without a common logic. Readers remember a few warnings but do not know why one product needs greater control, which signals are really worth examining, or when to walk away from a transaction.

A culture of prevention is not built by memorizing a list of precautions. It must help people, sellers, and organizations understand the logic of risk.

Why might inexpensive medicine matter more than an expensive product? Why does genuine packaging not guarantee genuine contents? Why do more discoveries sometimes signal worsening conditions and sometimes better supervision? Why can a report left unanswered become more damaging than silence?

Answering these questions turns prevention from a scattering of recommendations into a form of social behavior.

In this section, we follow four foundational principles: value, appearance, follow-up, and education. We then reach what much counterfeiting hides behind: the unseen, unreported part that can be called the “counterfeiting iceberg.”

First Principle: Anything Valuable Needs Proportionate Security

Value is more than price.

A package of medicine may be inexpensive, but its value is bound to a patient's treatment and life. A small part in an aircraft or industrial machine may account for a negligible share of the whole system's price, yet its failure can halt a mission. A certificate or identity card may consist of just a few grams of paper and plastic while representing access, authority, or competence worth far more than the document itself.

Security should therefore not be calibrated to the physical object's price. We must consider which decision would change if counterfeiting succeeded and what harm could result.

This simple question sometimes produces an unexpected answer. An expensive luxury item may present mainly financial risk, while a cheap cable or brake part may threaten life. Forging an administrative stamp may cost very little, yet lead to a property transfer or the assignment of sensitive responsibility.

A target's value is not the same as its price tag.

Understanding value is the first step in setting the level of protection. If the consequences of failure are limited and reversible, a simpler system may suffice. If counterfeiting can affect health, national security, substantial assets, or public trust, protection needs more layers, more continuous oversight, and a faster response after detection.

Professional prevention begins by asking: if this claim is false, who will be harmed, and how?

Second Principle: Look at Appearances, but Do Not Stop There

People need signals in everyday life. Logos, stamps, packaging, sealed packs, letterheads, QR codes, and serial numbers help us decide without fully examining every product or document. The problem begins when we confuse the signal with its backing.

An official appearance can become detached from an official reality.

Packaging may be genuine while its contents have changed. A valid code may be attached to a different product. A serial number may genuinely have been issued but then repeated. A stamp may belong to a real institution that did not issue the document.

Even the verification page can be part of the deception.

Fraudsters do not usually create something wholly alien to their audience's experience. They imitate the very signals people have learned to trust. The more credible a signal is in a market, the more attractive it becomes to counterfeit.

One simple principle must therefore become a habit:

Treat the signal as the doorway to examination, not the end of it.

A hologram must connect to the manufacturer, product, and accountability process. A code must lead to a known authority and interpretable data. An invoice must record the real transaction in the necessary detail. Packaging must be consistent with the product's other characteristics and supply route.

This is how we recognize the cotton-stuffed champion of anti-counterfeiting: imposing from a distance, with no real relationship behind it. If the feature can be detached from the product, the code can lead to any page, and warnings have no consequences, all the security sparkle serves only to reassure the customer sooner.

Third Principle: Trust Needs a Trail

Verbal trust is easy at purchase. The seller says, “It's genuine,” the buyer accepts, and the transaction ends. Security's value becomes apparent when a dispute arises days or months later.

What remains?

If the answer is only “the seller's word” or “the package's appearance,” the transaction has a weak memory. But with a detailed invoice, tracking number, seller identity, verification history, and accountable authority, trust can defend itself.

Being traceable means the claim, route, and responsibility remain connected.

In a defensible transaction, it must be possible to establish what was delivered, by whom, when, with which specifications, and under what conditions. A valid document also needs a clear issuer, number, status, and possibility of revocation or examination. In a supply chain, movements must be recorded sufficiently to identify the scope of damage and recall suspicious goods when a problem is detected.

A trail is not an aimless accumulation of data. Recording information no one reads or can interpret creates no security. A trail must serve a real question: where did this product come from? Who received it? How often has the code been used? Which batch needs recall? Who changed the data?

A system that records everything but has no answer in a dispute is more an archive than a security system.

Fourth Principle: Education Should Make the Right Questions Normal

Public education should not turn people into experts in printing, metallurgy, pharmacy, and cybersecurity. That goal is both impossible and a polite way of transferring the system's responsibility to consumers.

Education's real purpose is simpler: make a few important questions part of normal behavior.

Buyers should know that a code without an authoritative source is not enough. Employees should know an official-looking document may not be official. Sellers should understand that a detailed invoice is not mere administrative ceremony. Organizational managers should know that purchasing anti-counterfeiting tools does not replace understanding risk and defining responsibility.

Good education starts with real situations. Rather than say “always be vigilant,” it shows what to do when facing an unknown seller, unusual price, unverifiable document, tampered package, or duplicate code.

In medical products, WHO's Member State Mechanism does not rely solely on detection technology. Governments bring together training, public communication, monitoring, stronger laboratories, inter-agency cooperation, and supply-chain protection. The World Health Assembly established the mechanism in 2012 with member-state participation, deliberately approaching the issue through public health rather than intellectual property alone. [3]

This experience shows that education works when embedded in an accountable system. If people are trained but have nowhere to report a suspicious product, education is half a bridge. If reports are recorded but the responsible institution does not respond, the bridge never reaches the other bank.

Prevention Is Not One Person's or One Institution's Job

A culture of prevention weakens when the entire burden falls on buyers. After every loss, one can say, “They should have been more careful.” That may be part of the truth, but it often hides a much larger part.

Was the seller accountable? Did the manufacturer provide an appropriate way to check? Was the verification system understandable? Did the regulator analyze reports? Was the official route accessible and affordable for buyers?

Consumers have a share in prevention, but they are the last link in the chain, not a replacement for every link.

Sellers must record and answer for their claims. Manufacturers must protect products and data against actual risk. Document issuers must enable verification, revocation, and correction. Trade bodies must clarify the boundary between formal businesses and high-risk routes. Regulators must turn reports into action, warnings, recalls, or follow-up.

The media have a role too. Sensational warnings may attract attention briefly, but if they portray the entire market as tainted and every signal as worthless, the result is general distrust. Responsible media name the risk precisely, explain the limits of evidence, and suggest practical behavior.

A culture of prevention is a network of responsibilities. If each link simply points at another, counterfeiting slips through the gap between their fingers.

The Counterfeiting Iceberg: What We See Is Not the Whole Reality

Imagine that the number of counterfeit goods discovered doubles in one year.

Has counterfeiting increased, or has supervision improved?

The number alone cannot tell us.

Production and supply of counterfeits may truly have risen. Customs, police, sellers, or the public may have become better at reporting. Detection tools may be more accurate, or inspections may focus on a particular field. Even a change in definitions, recording practices, or institutional priorities can increase case numbers.

This is the logic behind the “counterfeiting iceberg.”

The visible part consists of cases, seizures, reports, complaints, and samples included in official statistics. Below the surface, a larger body may remain hidden: undetected counterfeits, victims who have not realized what happened, unreported cases, and violations recorded under a different heading.

Criminology calls this gap between actual and recorded crime the “dark figure of crime.” The United Nations Office on Drugs and Crime explains that unreported and undetected offenses limit the validity of relying solely on official statistics. Victimization surveys are therefore used alongside police data to illuminate the less visible part of the problem. [1]

The concept was originally developed for general crime statistics, not product counterfeiting specifically. Its logic nevertheless applies here: discoveries do not show the actual number of cases. They reflect a combination of offending, supervisory capacity, willingness to report, and recording practices.

The tip of the iceberg is real, but it is not the whole iceberg.

How Should We Read Detection Statistics?

Seizure and detection data are extremely valuable. They can reveal product types, transport routes, countries of origin, packaging methods, and changes in fraudsters' techniques. The problem begins when, without considering how the data were produced, we treat them as the true scale of counterfeiting.

The OECD–EUIPO report Mapping Global Trade in Fakes 2025 draws on customs seizure data from the World Customs Organization, the European Union, and the United States. Its authors explicitly explain limitations such as differences between datasets, product classifications, and outliers. Its scope is also restricted to intellectual property infringements in cross-border trade; it does not cover all low-quality or mislabeled products, or nonmaterial forms of counterfeiting. [2]

This explanation does not diminish the report. On the contrary, it shows that good data provide more than a number: they explain its limits.

Reading detection statistics requires at least five questions:

Was the definition of counterfeiting the same in the periods being compared?
Have inspection levels and detection budgets changed?
Has a particular route or market received more scrutiny?
Have the public and sellers reported more?
Do the data measure cases, items, or monetary value?

A thousand small packages and one large consignment can produce completely different pictures under two indicators. More seizures may coincide with a lower total value, or vice versa. Neither makes complete sense without context.

Statistics become dangerous when they speak with more confidence than their capacity warrants.

More Detection Is Not Always Bad News

At first glance, more discoveries look negative: more counterfeiting has been found. But if those counterfeits were already present last year and simply went unseen, the increase may show that the system is becoming active.

Reporting has improved, people know whom to contact, inspectors have been trained, or screening technology has become more accurate. A higher figure does not necessarily mean a more contaminated market. Perhaps eyes have opened wider.

WHO's activity report on its global medical-product surveillance system discusses increased reporting alongside stronger monitoring networks and information exchange. WHO itself frames its response in three parts—“prevent, detect, and respond”—and emphasizes that better detection must lead to prompt, proportionate action. [3]

Fewer detections are not necessarily good news either. Counterfeiting may have decreased, or inspections may have fallen, people may have lost faith in reporting, or fraudsters may have chosen harder-to-detect methods.

Without understanding the system that produced it, a number is silent. We often put our own words in its mouth.

Detection Without Consequences Does Not Produce Prevention

Suppose a counterfeit product is detected. The sample is seized, a report prepared, and a short news item published. Is the job done?

The main question has only just begun.

Which route brought the product in? How many items from the same batch were distributed? Has the identifier or seller account been blocked? Have previous buyers been warned? Has the system weakness been corrected? Can the offender return tomorrow under another name?

Detection that removes only one product while leaving its entry method untouched is closer to clearing away evidence of crime than preventing it.

Deterrence is not built solely by increasing punishment severity either. A research review by the US National Institute of Justice emphasizes that, for many crimes, the actual and perceived likelihood of detection and enforcement has a greater deterrent effect than the nominal severity of punishment. This conclusion comes from US criminological research and should not be treated as a universal rule for every culture and crime. But it offers a clear lesson for counterfeiting: a severe punishment rarely imposed may achieve less than a system in which detection and response are swift and likely. [4]

Fraudsters calculate too. If detection is unlikely, reports go unanswered, and returning to the market is easy, severity on paper does not necessarily change their calculation.

Prevention becomes serious when counterfeiting ceases to be a low-cost, low-risk activity.

Reporting Must Lead to an Outcome

Reporting something suspicious is a form of participation in public security. But moral exhortation alone creates no culture. People report when the process is understandable, inexpensive, and trustworthy.

Reporters need to know what information is required, how their privacy is protected, which tracking number they receive, and when they can expect a response. If a report disappears into silence, they are less likely to participate again.

Worse, an unanswered report can send the reverse message: “Even if you notice, nobody can do anything.”

A culture of prevention needs a feedback loop. Reports must be examined, findings returned to the relevant links, and public warnings, process corrections, recalls, or legal action initiated where necessary.

Not every report proves counterfeiting. Some suspicions are mistaken; others arise from quality defects or system failures. A professional response must clarify these differences. Reporting aims to enable examination, not manufacture accusations.

Asking Questions Is Not a Sign of Distrust

In some markets, asking questions is still treated as unwelcome. Buyers fear that requesting an invoice, verification, or an explanation of origin will offend the seller. An employee may likewise regard rechecking a document as an insult to an applicant.

This culture unintentionally benefits counterfeiting.

A responsible question is not an accusation. Sellers who stand behind their goods should be able to explain specifications, invoices, and accountability routes. Issuers of valid documents are not harmed by verification either. On the contrary, verification enhances a genuine document's value.

Counterfeiting benefits where trust is confused with silence.

A culture of prevention must turn questioning from a sign of rudeness into a normal part of a transaction. Just as checking the price, weight, or expiry date is normal, asking about invoices, authorizations, and follow-up should be normal too.

Healthy trust does not run from questions.

Small Habits, Collective Effects

A culture of prevention does not emerge from a short campaign or circular. It grows through repeated small behaviors.

Buyers ask for invoices. Sellers record specifications accurately. Employees verify documents through the right authority. Manufacturers investigate duplicate codes. Regulators keep reporters informed. The media distinguish “suspicious” from “counterfeit.”

Each behavior is small, but together they change the fraudster's calculation.

Weak habits accumulate too: sham invoices, payments into unrelated accounts, trust in sealed packaging, codes without an authoritative source, unanswered reports, and silence to preserve the market's appearance. Counterfeiting draws strength not only from fraudsters' technology but also from our convenient, unrecorded habits.

A culture of prevention means making the sound route easier and more visible than the obscure one.

The Honest Seller's Role

Reputable sellers sometimes assume their history and reputation are enough to earn trust. These are important assets, but they should not replace records and transparency.

Honest sellers, in fact, gain most from prevention. Accurate invoices, clear answers, and verifiable identity distinguish them from unidentifiable sellers. The more the market becomes accustomed to defensible signals, the less fraudsters can exploit the trade's general credibility.

Transparency has a cost, but lack of transparency imposes a hidden cost on the entire market too.

A single counterfeit case may occur at an unknown business, yet news of it can erode trust in a whole trade. In those circumstances, silence within the trade does not protect honest participants' reputations. Clear distinctions, proper handling, and public education provide a stronger defense.

A trade's credibility is preserved by showing the difference between misconduct and professional behavior, not by hiding violations.

The Manufacturer's and System Designer's Role

Manufacturers should not leave authenticity features solely to graphics or marketing teams. Every security feature makes an implicit promise: “This mark will help you identify a legitimate product.”

If that promise is not real, the feature itself becomes part of the problem.

Design must follow the type of attack. Is the risk packaging imitation or content substitution? Could an identifier be duplicated? Does an internal employee have data access? Can consumers distinguish an official authority from a fake page?

The feature should be understandable without exposing all the security. Some elements are designed for the public, some for the chain, and some for specialist examination. What happens after a suspicious observation must also be clear.

A system that only answers “valid” and never warns about repeated use or unusual patterns may be more a customer-soothing tool than a detection tool.

The Regulator's Role

A regulator does more than issue authorizations and collect complaints. It must be able to build a picture of risk from scattered data.

Which products attract more reports? At what stage does counterfeiting occur? Which types of sellers or distribution routes recur? Has one identifier or packaging method appeared in several cases?

One complaint may be an individual dispute. A hundred similar complaints are no longer an individual issue: they form a pattern the system must recognize.

Good supervision connects case-by-case action to institutional learning. Every discovery should add to the system's knowledge. If cases are closed and their lessons remain in the archive, counterfeiting will repeatedly enter through the same door.

A discovery that adds nothing to the system's memory must be repeated from scratch every time.

News Does Not Shrink the Iceberg

Sometimes a large seizure is announced triumphantly: thousands of goods confiscated, a workshop closed, suspects identified. The response is necessary and can strengthen public confidence in supervision.

But a spotlight does not shrink the tip of the iceberg.

The news should open the way to further questions. How long had the operation been active? How many goods had already reached the market? Which weakness enabled it? What will change to prevent recurrence?

We should not belittle an operation's success, but neither should we equate it with solving the problem. A large seizure sometimes indicates active supervision; at other times it reveals that a network has been growing for a long time. Sound interpretation needs context.

A society that sees only discovery headlines may swing between false reassurance and public panic. A culture of prevention must move beyond news to learning.

Prevention Does Not Mean Reducing Counterfeiting to Zero

No system can guarantee that counterfeiting will never occur. The greater the target's value, the stronger the attacker's incentive to try new routes. Technology is available to both sides.

The realistic goal has four parts:

Make counterfeiting harder;
Increase its cost;
Increase the likelihood and speed of detection;
Limit the damage after detection.

This definition distances prevention from advertising promises. There is no “impossible-to-counterfeit” feature. There are solutions offering greater or lesser resistance against a particular attacker over a particular period.

A culture of prevention is not complete and fixed either. It must learn, correct itself, and accept that some of yesterday's signals and methods are no longer sufficient.

Security falls behind if it stands still.

What Does a Culture of Prevention Mean?

It means society recognizes counterfeiting risk without descending into absolute suspicion. People can ask questions without feeling they are making accusations. Sellers see transparency as part of their credibility. Manufacturers begin security with design rather than a final label. Regulators turn reports into learning and response.

In such a culture, authenticity is not a luxury. It is part of the real quality of products, documents, and services.

The invoice is the transaction's memory. Verification is the recipient's right. Reporting is participation in public security. Enforcement does more than punish an individual offender: it sends the entire market a message about the cost of deception.

A society that reacts only after a crisis is always chasing the iceberg's tip. A society with a culture of prevention also sees below the waterline: silences, unreported cases, habits that leave no trail, theatrical tools, and weaknesses that have not yet become cases.

Counterfeiting prevention means preserving the ability to trust without gullibility, and preserving security without becoming trapped in fear.