In order to not be trivially defeatable, it sounds quite hard. You can't, for example, use sequential blocks of ids — far too easy for a counterfeiter to reverse-engineer valid ranges. Which means that you either generate them through some cryptographic signing process - non trivial and the risk of compromised keys, or just generate random guids centrally meaning there's a request/response somewhere in the production cycle to get ids, or batches of ids - also non trivial.

The whole thing sounds like it's a really obvious and simple solution at a glance, but as you dig into it it seems hard, especially for smaller players, and only shifts the counterfeiters' workload (now you need to figure out how to steal barcodes, not impossible depending on how much money you invest).