Can a QR tell you if a collectible is fake?
Some say you can read the QR on a collectible figure box to see if it is genuine. This page covers what a QR can and cannot tell you, and how to check the address.
What a QR points to
A box QR is a picture that holds one web address. Reading it takes you to that address. It does not tell you whether the box or what is inside is real.
Resellers say the QR on a genuine box leads to the brand's check page. For POP MART, the check address is reported to sit under m-gss.popmart.com.
The risk runs the other way. Fake boxes have been reported with a QR that leads to the same official address. The address is official and the item is fake.
How to read an address
Look at the host
The part that matters is the host, before the first slash. A host that ends in popmart.com belongs to that domain.
The path and anything after a question mark can be dressed up freely, so they prove nothing.
Read from the right
Read a host from right to left. The owner of popmart.com.evil.xyz is evil.xyz, not popmart.
What this app does and does not do
What it does
It compares the QR host with registered official domains. The result is one of match, mismatch or not in the list.
It warns about lookalike spellings, hyphen variants, subdomain tricks, http, shortened links, addresses with @ and number addresses.
It gives you six items to check with your own eyes.
What it does not do
It does not judge genuine or fake. A match does not mean genuine.
It does not send the address or photo to any server. All of it runs on your device.
The domain list holds only brands with a confirmed source. Right now that is POP MART, from two secondary articles. No primary notice from the brand was found.
Steps
Read the QR and look at the host before you open anything.
If it matches, go on to the checklist and look yourself: print quality, a sticker on top, a comparison with official photos, the seller, the price and a purchase record.
If it differs or is not in the list, do not open it. Find the check feature in the brand's official app or site yourself.
For secondhand deals, ask the seller for photos of the whole box and the QR area, then try them here.
Tricky address shapes
Lookalike spelling
Something like popmrt.com, with a letter dropped or swapped. It looks the same at a glance.
Hyphens and extra words
Addresses like pop-mart.com or popmart-official.shop add a hyphen or a word. Swapping a letter for a digit, like 0 for o, is common too.
Subdomain tricks
popmart.com.evil.xyz puts the official address first and another one after it. Read the host from the right.
Shortened links and http
A shortened link hides where it goes. This app treats it as not in the list and warns.
http is an unencrypted connection. Even on an official host, it gets a warning.
If you get stuck
It matched but the item is fake. Can that happen?
Yes. Fake labels with an official address have been reported. Use the checklist and check the seller too.
No QR found in my photo
Retake it straight on with the QR large in the middle. Change the angle if there is glare.
The camera will not start
Check that the browser has camera permission. If it still fails, upload a photo instead.
Why are there no other brands?
Domains without a confirmed source are left out. A wrong list is worse than a short one.