Originally published on Medium.
On August 18, Karnataka’s drug regulator raided a farmhouse near Bidadi and found more than 7,400 vials of cheap medicine refilled and relabelled as premium injectables, some under a multinational’s name, with QR codes printed on the labels. Since then: 16 licences cancelled, 8 suspended, 7 arrests, a kingpin picked up at Bengaluru airport, and a public warning to report “non-scanning QR codes.” The next batch will scan.
On August 18, 2026, the Drug Enforcement Wing of Karnataka’s Food Safety and Drug Administration raided a farmhouse at Kurubarakeranahalli, near Bidadi, about 30 kilometres from Bengaluru. What it found, per The Federal, was an unlicensed unit allegedly repackaging and relabelling medicines. The inventory, per The Federal and Medical Dialogues: 5,640 vials labelled Cefiavigent 2.5 Injection, valued at 3.38 crore rupees; 1,531 vials of a second injectable; 264 vials “carrying counterfeit Pfizer labelling” for Emblaveo, valued at 20.59 lakh; 30 boxes of expired drugs; and the filling equipment, forged labels and stamps, and packaging material to make more. The seizure was put at about 5.05 crore rupees.
The method was not sophisticated. “The investigation revealed that the premises were being used to procure lower-cost medications from other states,” the FSDA said. Those medicines were “refilled into new vials and relabelled to counterfeit expensive life-saving brands,” in ThePrint’s account. And the labels carried QR codes, which the FSDA “found to be non-functional during verification.”
Hold that last detail. The counterfeiters knew the label needed a code. They printed one. It did not work, which made the fakes easier to prove once the FSDA had them in hand. The raid itself followed a police tip-off.
Six weeks, seven arrests
By September 12, Bengaluru police had arrested Veeresh Kumar Jain, owner of Krupa Healthcare, a pharmacy near Minerva Circle, whom investigators suspected of being part of a network that “supplied counterfeit medicines to more than 90 hospitals and clinics in Bengaluru and surrounding areas,” per The South First. That is a suspicion, not a finding.
On Sunday, September 20, the FSDA announced action against 24 wholesale and retail drug suppliers in Bengaluru, Hubballi and Belagavi: 16 licences cancelled, Krupa Healthcare and a hospital drug centre among them, and eight suspended, including Pfizer Ltd’s carrying and forwarding depot at Kempalinganahalli in Nelamangala taluk. Health Minister U T Khader’s stated reason for the depot: “We have stopped Pfizer’s sale in the state because they did not cooperate with the investigation.” Of the distributors, he said: “On the surface, it appears that most of them are hand-in-glove with the producers (of fake medicines). When we asked them to recall medicines already distributed, they showed no interest nor were they cooperative.” Pfizer’s response, via ThePrint: “Patient safety and product quality are of the highest priority for us at Pfizer.” The company said it had removed batches whose numbers had been copied by counterfeiters and continues to work closely with the authorities to resolve the open queries. A suspension is a regulatory step, not a finding against the company whose name was on the counterfeit, and it is worth saying so plainly.
An Assistant Drugs Controller was also suspended, for alleged dereliction of duty, per The Federal. A Special Investigation Team was formed. “Those who play with people’s lives will not be tolerated,” Khader said. “Once the SIT submits its report, strict legal action will be taken against all those found guilty, regardless of how powerful or influential they may be.”
On September 28, R. Prashanth, 36, described by investigators as the network’s alleged kingpin, was arrested at Kempegowda International Airport on arrival from Sharjah; he had left for Azerbaijan after the raid. By September 30 a Chennai distributor, Balasubramanian, had become the seventh arrest. The criminal case runs under the Drugs and Cosmetics Act, 1940.
And the Health Department issued its advice to the public: “purchase medicines only from licenced pharmacies against valid tax invoices and report suspicious packaging or non-scanning QR codes on labels to Drug Enforcement authorities.”
Why there was a QR code on a fake vial at all
Because buyers expect one, and the law is moving to require one. Since August 1, 2023, under notification G.S.R. 823(E) of November 2022, India’s 300 top-selling brands, listed in Schedule H2 of the Drugs Rules, must carry a bar code or QR code holding the “unique product identification code; proper and generic name of the drug; brand name; name and address of the manufacturer; batch number; date of manufacturing; date of expiry; and manufacturing licence number.” On June 22, 2026, notification G.S.R. 506(E) extended the schedule to all vaccines, all antimicrobials, all anticancer drugs and all narcotic and psychotropic drugs, in force from July 1, 2027, with antimicrobials following on July 1, 2028. Medical Dialogues described the move as aimed at “enhancing drug traceability, strengthening supply-chain monitoring, and curbing misuse of high-risk medicines.”
A premium injectable without a code on the box already looks wrong to a hospital pharmacist, and from July 1, 2028, when all antimicrobials come under Schedule H2, it will be wrong by law. So the farmhouse printed codes. This batch’s codes did not resolve, and the FSDA’s advice to report “non-scanning QR codes” catches exactly that version of the fraud.
It does not catch the next version. A QR code is a picture. Photograph the code on one genuine carton and print it on ten thousand labels, and every one of them scans, and every scan resolves to the genuine record for a batch that exists. The hospital pharmacist who scans it sees the real manufacturer, the real batch, the real expiry date. The code confirms that the label was copied well. It cannot confirm that the liquid behind it came from the manufacturer, and in Bidadi the vials were new glass holding somebody else’s medicine.
A mark that can be copied cannot, on its own, authenticate an object. The mark has to answer differently every time it is asked.
When the vial can answer for itself
The FSDA did one more thing that matters: it blocked the batch numbers on its portal. That is the right instinct, and it shows the limit. A batch number is printed on every vial that claims the batch, genuine or refilled, so blocking it is a blunt tool: it stops the fakes carrying that number and any genuine stock that shares it.
A cryptographic identity on each vial, carried on the closure or seal rather than printed on the glass, changes what a wholesaler and a hospital pharmacy can check. A tap can return what the manufacturer and each handler have recorded against that tag: this vial, this batch, filled on this date, shipped to this wholesaler, received by this hospital, provided each party records its step. A copy of what the tag has said before should fail, because the secret key that produces each answer is designed never to leave the chip, so a copy cannot answer a challenge it has not seen. And a tag built into a tamper-evident seal reports the seal as opened once it is broken, so a genuine vial emptied and refilled would fail the check, and a new vial from a farmhouse would have no valid tag to present. The check can be per vial, not per batch, which is the difference between quarantining 264 vials and quarantining a product.
The mechanism is described in tap to passport. How it fits hospital procurement and the serialization rules that already exist is on our pharma page.
What the wholesaler and the manufacturer should have been able to prove
Per vial, three things. That this vial, sealed, is the manufacturer’s, from this batch. That it reached this hospital through this wholesaler, each handoff recorded by a tap on the vial, not only on an invoice. And that the seal has not been opened since the vial was filled.
No one in the chain could prove any of the three, and a regulator had to prove the negative instead, with a raid, a laboratory and seven arrests. Until the vial can answer for itself, the Health Department’s advice stands: a licensed pharmacy, a valid tax invoice, and a report when a code does not scan. Just do not mistake a code that scans for a vial that is real.
Aeroz, Making Authenticity Checkable. Visit aeroz.io to learn more & get in contact with our team via [email protected].
© 2026 Aeroz. All rights reserved.