Russia has a working system that tracks retail sales of individual cans of beer, bottles of milk and such. Initially it was introduced to track things like shoes and furs that were massively counterfeited, but then expanded to include other goods. So now in a grocery store you use it, for example, for all milk products (milk, cheese, ice cream, etc.), vegetable oil, beer, mineral water. Technically you just scan a different barcode (QR code). There's also an app you can use to scan the thing and get more information, such as the exact producer. The general idea was to fight counterfeit goods, but as a side effect it also enforces shelf life rules or may help to find a drugstore that has a specific drug.

So it is possible and not that expensive even as a country-wide system for goods that cost around $1 (a typical can of beer).

And yes, it does have additional codes for larger-scale packages. So a pack of cigarettes gets its own code, a carton gets its own code, a box of cartons gets its own code. A wholesaler can just scan the box and the system updates the status of every pack inside.

What am I missing about this? Couldn't the scammer just replicate the QR code of a legit shop? I thought the point of counterfeit goods was to fool you into buying them instead of the real thing. I guess part of the process would have to be verifying that every shipment of goods received was accurately tracked from a valid "ship from" address, but I have to imagine there's a lot of common warehousing in use for bulk goods. I'm not understanding how the QR code helps solve that.

Maybe a unique bar code per-item that includes some private hash information that makes it unique to the producer? Sort of an electronic signature for physical goods? Then if there's a centralized database, copying the QR codes wouldn't do much good. You might be able to slip in one if it is sold before the real version. But each subsequent copy could be caught.