If you want a guarantee that you are getting the genuine article, buy legitimate from GOG, retail, Steam, or something official.

If you bought from a shady third-party reseller to save money and it turns out the key was already used, TOUGH LUCK. Caveat emptor - buyer beware. You cheaped out, accepted the risk, lost your money, it's your fault. CDPR is not obligated to help you out if you bought from an unofficial, unauthorized vendor.

+1

I know right, might as well just pirate the game at that point, it's not like CDPR see any money either way.