Serial numbers done right

The serial number is the least glamorous part of product identity and the easiest to get wrong. Most brands that add one reach for the obvious scheme: start at 0001, count up. That single decision leaks your business metrics to anyone who buys two products, and it hands counterfeiters a free catalogue of valid numbers.

The eighty-year-old warning

In the Second World War, Allied statisticians estimated German tank production from the serial numbers of captured and destroyed vehicles. Because the numbers were sequential, a handful of samples revealed the size of the whole series. The statistical estimates, checked against German production records after the war, were strikingly close; conventional intelligence had overestimated by several times. The method is taught today as the German tank problem, and it works exactly as well on a streetwear drop as it did on tanks: sequential serials on two units, bought weeks apart, bracket your production volume for anyone who cares to look. Competitors care. So do resellers pricing scarcity.

The modern attack is even simpler

If serials are sequential and your verification page lives at a predictable address, a counterfeiter doesn't need to copy a real serial. They enumerate: try every number in order, harvest the valid ones, and print your own genuine serials onto their fakes. Security engineers call the broader pattern an enumeration attack, and the defence is the same everywhere it appears: identifiers must be sparse. If a thousand real units live in a space of a trillion possible serials, guessing a valid one is a lottery ticket, and a harvested list is the only way in, which is exactly the behaviour a brand can detect.

What a good serial looks like

• Random, in a large space. On the order of forty bits of randomness or more: a trillion possibilities, so valid serials cannot be guessed and reveal nothing about volume or sequence.
• Unambiguous for humans. People read serials aloud, type them from tags, and copy them from photos. An alphabet without 0/O and 1/I confusion (Crockford's Base32 is the well-known one) removes the failure mode where a correct-looking serial is wrong.
• Checksummed. A check character makes typos fail loudly instead of resolving to somebody else's item. The difference between "serial not found, check the last character" and quietly showing a stranger's product page is the difference between a typo and an incident.
• Resolvable by one standard code. Printed as a GS1 Digital Link QR, the same identifier serves the buyer's phone, the retailer's scanner, and the recycler's intake system, instead of one label per audience.

What a serial can and cannot prove

A well-designed serial identifies. It does not authenticate: a counterfeiter who photographs one genuine tag can print that valid serial a thousand times. Identification tells you which item this claims to be; the cryptographic layer (a chip that signs a fresh code on every tap) proves the claim. The ladder from serial to QR to cryptographic NFC is laid out in Product identity without an app, and it is exactly how SAGAS Commerce issues identities: sparse, checksummed, human-safe serials at the bottom, cryptographic verification on top.

The German tank problem estimates and their post-war verification are standard published history (Ruggles and Brodie, 1947). Design constants here (forty-plus random bits, Crockford Base32, check characters) describe SAGAS's own serial scheme; your volumes may justify different parameters, but the properties, sparse, unambiguous, checksummed, standard-resolvable, are the load-bearing part.

General information, not legal advice. Verify obligations against the cited regulations on EUR-Lex, or with counsel. Citations checked August 11, 2026.