At least for Janoshik, the QR code leads to a page on the lab's own web domain for the particular test. If the vendor photoshopped anything, it wouldn't change on the lab's website.
Correct, unfortunately. And vial cap colors aren't a reliable guide for that.
I am probably more skeptical of QR codes nowadays (post our "Covid-Era") than I am of just about anything on the web. I don't trust that the website that QR leads you to is always trustworthy ... even for Jano tests.
During Covid, my employer starting mandating the Covid shot. Well, they began MANDATING PROOF of the Covid shot. By "proof," they meant a computer-generated and "verifiable" record from the administering lab/pharmacy/etc. Basically, no handwritten cards and a link or QR code they could use to verify the info.
It was then that I learned that QR codes can direct you to VERY official and exact replica copies of major websites that appear 1000% LEGIT ... the browser address, the image, the links embedded on the page ... all of it. It legit looked EXACTLY right.
The ONLY way to know that it wasn't was to know to fixate your eyes on the browser while the link opened and watch it very very quickly roll over 2 or 3 times before landing on the final "verification" page. It happened so fast and if you didn't know to really really watch it, you would have no idea that it just flipped the link. No sh*t ... it looked IDENTICAL to Wal-Mart's pharmacy pages that other people had actually received the jab and a QR code from Wal-Mart. The similarities between the real one and the "dupes" were uncanny.
Ever since then, I've been super leary of QR codes in general.
I'd rather use a fresh new tab, type in the lab myself, click on the verify link, type in the # myself and press "verify."
In theory, "TRUST, BUT VERIFY" is a cute theory and all ... but I don't waste my time with the first part at all. I just skip on to the verify part.