How a signed QR code stops invoice forgery
Forged commercial invoices cost gold exporters real money at the border. Here is what the QR on an AurumIQ invoice actually proves, and what it does not.
A commercial invoice for gold jewellery is a high-value document: it states the karat, the net weight, the gold rate and the making charge that customs and the buyer's bank rely on. Copying the layout of a real invoice is trivial, which is why paper alone is easy to forge.
What the QR contains
Every AurumIQ invoice carries a QR payload with the invoice number, date, consignee, total pieces, net weight and amount, plus an HMAC signature computed with a secret that never leaves the issuing workstation and the AurumIQ server. Change one digit of the weight and the signature no longer matches.
Five verdicts
- Valid — the signature matches and the invoice is on record.
- Verified offline — the signature matches but the workstation has not synced yet (typical within minutes of issuing).
- Tampered — the payload was edited after signing.
- Cancelled — the exporter voided the invoice; the printed copy is no longer valid.
- Invalid code — not issued by this exporter at all.
What it does not do
The QR proves who issued the document and that it is unchanged. It does not assay the metal. Pair it with serialised piece labels so each item can be checked back to the invoice line it was shipped on.