E-cigarette products are rife with counterfeits and often use the scratchpad-code. It's a cat-and-mouse game still. They used to just spam one code on all the boxes so you could easily see messages like "this code has been checked 300 times" but later there were more codes and you would see they were only checked <10 times. Given that many consumers aren't even checking the codes, they probably get away with a lot.