An activation key is not a license. How can you verify the origin of secondary software?

This expert interview with licensing specialist Igor Weinlich highlights the legal risks of buying software activation keys without transfer documentation and explains how organizations can identify forged licenses to ensure full compliance.

How do you recognize legal secondary software and avoid falling for a seller who delivers only an activation key instead of a license? Igor Weinlich, a licensing specialist at Forscope, shares his experience with vetting offers and license transfer documents. He explains which discrepancies should raise red flags and why even authentic-looking documentation may not be a guarantee.

What a big problem does the grey market in licenses and the sale of activation keys themselves present?

The fundamental problem is that the customer often cannot distinguish between a key and a license. A key is a combination of letters and numbers that unlocks a program. However, that does not mean its holder has the right to use the software. To have that, they need a legal basis. The user must be able to prove that they properly bought the software as new, or that the right to use it was transferred to them. It is precisely this authorization that forms the essence of a license. If a customer buys only a key without documented usage rights, they may technically unlock the program, but the key itself does not authorize them to use it.

So a customer can have working software and yet not have the authorization to use it?

Yes. And the risk associated with such use is borne by the end customer. The sale of a key itself is something different from the sale of a license - that is, the authorization to use the software. Some customers buying second-hand software are misled; others may go into it consciously. However, they often assume that if they have an invoice, they automatically have the right to use the software. The simplest form of this trading looks like a fraudulent seller offering, for example, the latest Office 2024 for a dollar, an euro, or perhaps two hundred crowns. Along with it, they explicitly state that they are selling a key, or they combine the terms "key" and "license."

In the case of customers, are we talking about private users or also about companies?

About both of these groups. The difference is mainly in the perception of risk. Companies are more worried that someone will come for an audit and check whether they are using the software legally. Truth be told, for a private user, the risk that someone will come to their home to check the software on their computer is rather theoretical. For companies, the risk is larger. At the same time, a question arises as to who is responsible for the purchase and use - whether it is the IT employee who acquired the software, the person who approved or paid for the purchase, or the company as a whole.

Does the sale of problematic keys concentrate only on cheap offers on the internet, or does it involve larger stores as well?

It is already making its way into public procurement. We have encountered situations where sellers create fake documentation for the key. At the beginning, they have a key, and to go with it, they additionally invent supporting documents intended to create the impression that it is a proper license. Subsequently, they sell the product as used software with a documented chain of transfers. They either invent this chain or they have several companies through which they resell it so that some chain exists. The prices are, of course, very low.

Is it difficult to uncover such forged documentation?

The legitimacy of a transfer is proven by documents. But paradoxically, with genuine second-hand licenses, it can be difficult to obtain the originals because many years have passed since the initial purchase. For example, you may be selling licenses that were originally purchased as Office 2016, but because the customer paid for continuous updates - so-called Software Assurance - they now have the right to the latest version, Office 2024. However, they may no longer have the original document from 2016 because they did not store purchase documents for ten years. Therefore, when proving legal origin, copies or extracts from various portals are also used.

What other complications accompany the sale of second-hand licenses?

A seller who forges documentation can easily create a document today that looks perfect at first glance. It is colorful, neat, and acts like an original. However, the appearance of the document alone says nothing about whether its content is true. For the buyer, it is often enough that they receive documents, and they believe what is written in them. But they no longer pick up the phone and call the original company to verify whether it actually sold the given number of licenses to another entity. So the problem is not just whether documentation exists. It is necessary to verify whether it corresponds to reality. That often does not happen.

Where do keys on the grey market actually come from? Are they real keys for specific software, or are they some kind of forged "master keys"?

On the internet, keys can be obtained from various sources. However, to understand, it is necessary to explain how volume licenses work. At Forscope, we sell perpetual licenses from volume licensing programs, where a single key can activate, for example, a thousand devices. So you do not have a thousand unique keys, but one shared key. Illegal keys can be bought, for example, in China, on eBay, or elsewhere. They can be of various types and allow, say, several hundred activations. For sellers of keys alone, that is enough for their business.

So the number of activations does not necessarily match the number of licenses the customer actually owns?

Activation itself is not proof of the right to use software. A key can have, for example, three hundred to five hundred activations. After they are exhausted, the software manufacturer either adds more or the key is replaced. We too can provide the customer with a different key if the activation capacity of the original key is exhausted. But that does not change the legal basis for using the software.

I would compare it to a car. When you lose a key or it wears out, you have a new one made. With it, you open and start the car again. But the key itself does not prove that you have the right to use the car. During a check, it is also not enough to show that it fits into the ignition. You need the relevant documents.

How do fraudulent sellers turn such a key into an offer for an allegedly proper license?

To test keys, stolen keys, or keys originating from China or other countries outside the European Union, they add forged documentation intended to prove the European origin of the license. Then they sell them as second-hand software. Some go even further and claim they are selling new software. They argue that although someone already bought the license, the software has not yet been installed. From a legal standpoint, that is nonsense. The decisive factor is that someone bought the right to use the software and is now transferring this right further. Whether the software was ever installed or activated is not relevant for distinguishing between new and second-hand software.

What do they supply to the customer when they claim it is new software?

Sometimes just an invoice. We often encounter this in Poland, for example. When the new acquirer requests documentation, the seller replies: "These are new licenses. Here is your invoice, that is enough for you."

You mentioned that the problem of fraudulent licenses also affects public procurement. What leads you to that conclusion?

We contact public institutions with requests under Act No. 106 on Free Access to Information. Where we suspected a problem, we ask what was delivered to them and how they checked it. The answers are sometimes quite vague. In one case, however, right in the published contract, we found data stating that the institution purchased Office 2024 Standard from the Enterprise Agreement program. So we pointed out that Office 2024 Standard was not offered in this program at all, and that in Enterprise Agreement, it was only possible to buy the highest edition, Professional Plus.

How did the institution react to the alert?

At first, they did not address it. Only when we tried to explain the problem to them using a simple example - that it is similar to buying an apartment on the tenth floor of a building that only has five floors - did they start resolving the situation with the supplier. The last response we received was that negotiations with them are continuing. This involved approximately two and a half million crowns paid for something that does not exist in the specified form.

I assume that on the buyer's side, it was a matter of trustfulness or ignorance rather than intent.

It could have been ignorance, but in my opinion, an IT employee should know these basic things, especially if they are in charge of the entire institution's IT.

How can a problematic offer be recognized? What should the customer check?

At Forscope, our approach is that we need to see the documents. When we have them available, we can find errors in them. Our colleague who is in charge of purchasing knows what the supporting documents should look like, what numbers make sense, and how individual licensing agreements are designated. An ordinary customer seeing such documentation for the first time has a much lower chance of uncovering discrepancies. But some errors can be recognized even without deeper licensing knowledge. For instance, when the documents state that someone bought Office 2024 back in 2022, when this product did not yet exist. In the documentation for one public tender, we also found a transfer of licenses to a company at a time when it had not yet been founded.

Do you have other examples documented?

Occassionally, I make purchases of suspicious software, which I then use to train our sales representatives. A specific example could appear here. They sometimes come to me saying that someone is offering the same product as us, but at half the price. I tell them: "Alright, let's take a look at what they are actually selling." I request such a product and buy a license. Naturally, I am also interested in all the supporting documentation I receive. Sometimes, even from the responses, it is clear that the seller does not know what they are selling. What they write does not match the options of the given licensing program. Sometimes I also get the impression that a bot is responding in the chat. These companies are often made up of a single person. The risk of such "business" is thereby minimized.

What realistically threatens a customer who buys a problematic key and starts using the software? And what is the seller's liability?

I would distinguish between two situations. If someone openly sells only a key and the customer buys a key, in my opinion, the seller does not face much risk. However, if they offer a license and instead supply only a key with fake documentation, I would already see fraud in that. They are misleading the customer by presenting documentation to them as proof of legal origin.

But we reach the question of who incurred damage and in what amount. On one hand, it arises to the person who bought such software, and on the other hand, to its manufacturer, who, however, may not be motivated to enforce such damages.

So sellers of problematic keys who participate in public procurement act as regular companies?

Yes. They are normally established companies, often with a single managing director. That person may have two or three other companies through which they create a chain of transfers. Then they apply for a public tender and compete like any other supplier.

What should follow if the documents look credible at first glance?

It still holds true that it is necessary to verify their content. If a supplier is listed in the documentation, you can contact them by phone or email and ask whether the invoice number and the specified product actually match. Of course, they might answer that it is a trade secret.

How does Forscope verify the legality of its own licenses? How do you proceed?

Exactly as I have just described. We screen our suppliers and verify the chain of transfers. We call individual companies and find out whether the listed licensing agreements actually existed. We perform the check in advance. Alternatively, we involve an auditor who verifies the licenses and prepares a report on them.

We described how "key-men" operate, who effectively offer illegal goods. On the other hand, what does trading in properly documented second-hand licenses look like?

Companies that buy up licenses hold auctions. They buy up licenses from a certain contract and then offer individual software packages. You can sign up for the auction and buy licenses. So it is visible who participates in these auctions and who buys. Within the EU, Germany is a major source of second-hand licenses. We too, in addition to direct buyouts, purchase from German partners.

If a company finds out it has purchased problematic software, can it be subsequently legalized?

No. You cannot subsequently legalize a counterfeit handbag either.