Originally published on Medium.
In the thirty days to 2 October 2026, counterfeit goods were seized, recalled, alerted on or prosecuted in at least a dozen countries. Counterfeit airbag inflators, malaria tablets with no malaria drug in them, eye injections in the wrong vial, cheese with a reprinted date, juice mixed in a Nairobi house, carpet carrying a forged safety label, 70,000 children’s toys that shatter at speed, half a million delisted product links in one region in one year.
Read the case files rather than the totals and something consistent appears. In almost every case the fake was identified by comparing the suspect object against a genuine one, in a laboratory or by a brand’s own expert, after the product had already been sold, installed or injected. That is the detection method the modern counterfeit economy is actually policed by, and it is expensive, slow, and available to no one who is about to use the product.
This is a longer piece than usual, because the pattern only becomes visible across a month of cases rather than in any single one. It sets out the record, then the six ways the fakes were actually found, then what the month says about each of the sectors where this matters, and finally the strongest objections to reading it that way.
The record
These are the cases from the four weeks to 2 October 2026 that carry enough published detail to say how the counterfeit was identified. Keep an eye on that last part as they go by, because it is the only thing they have in common.
Take them in the order they arrived. On 14 September, San Francisco police announced the seizure of more than 20,000 counterfeit pills pressed as Xanax, oxycodone, hydrocodone and cyclobenzaprine, an investigation that ran backwards from a sixteen year old’s death; the compound involved was named by the medical examiner, from blood, after the fact, and does not show up on a fentanyl test strip. On 23 September, NAFDAC arraigned two men and a pharmaceutical company in Jos over counterfeit Coartem that laboratory assay showed contained zero active ingredient, a case that began when Novartis reported it. On 24 September, Kenya’s Pharmacy and Poisons Board alerted on falsified Lucentis in two named batches, found in post-market surveillance by comparing the suspect vials against genuine Novartis stock. On 25 September, Ford recalled 11,405 trucks over potentially counterfeit capacitors in the centre-stack display, a scope established by serialized traceability from the capacitor lot through two serial numbers.
The last week of the month ran the same way. On 28 September the Karnataka investigation reached a seventh arrest over vials refilled and relabelled as premium brands, whose counterfeit labels carried QR codes that did not work when scanned, and Mexico’s COFEPRIS alerted on thirteen lots across four medicines after a manufacturer judged from photographs that the packaging was not original. On 29 September, Taiwanese police announced more than 70,000 counterfeit Beyblade toys, identified by mailing photographs and samples to the authorised distributor for an opinion; United States Customs and Border Protection published about $856,000 of September seizures at Virginia ports, two of the five being counterfeit certification marks rather than counterfeit brands, all found by physically opening containers; and the Justice Department charged two men over a counterfeit Ozempic scheme in which the packaging, inserts, pen labels and needles had all been reproduced.
On 30 September, CBP officers at Chicago O’Hare pulled two parcels holding 200 counterfeit Cartier watches with a genuine value of $28 million, and could not make the determination at the port: the parcels went to CBP’s trade specialists for trademark analysis. The same day, South Africa’s Hawks searched a Gqeberha shop after brand representatives ran test purchases in June and returned for more, and Kenya’s NACADA seized thousands of bottles of counterfeit spirits carrying counterfeit excise stamps. Then on 2 October, Maharashtra’s FDA seized 430 kg of counterfeit Amul cheese at a house where expiry dates were being removed and reprinted, and Kenyan detectives raided a Kabete homestead making counterfeit juice with rubber stamps, brand stickers and an expired standards-mark certificate.
Running underneath all of it, the counterfeit airbag inflators marked DTN60DB, now at eleven deaths and three serious injuries, where the only means of identification is reading a serial sequence off a label inside a dashboard, because no vehicle identification number anywhere points to one.
Fifteen cases, nine countries, eight product categories. One of them used a serial chain, and it is the only one of the fifteen where the scope of the problem was bounded rather than estimated.
Six ways a fake actually gets found
Strip the cases down and the record contains six detection methods, no more. They are worth separating because they differ enormously in cost, in delay, and in who is able to run them.
The brand expert, in person. Someone who knows the genuine product handles the suspect one. In Gqeberha, Adidas representatives made a test purchase in June, then came back for Nike and Lacoste before a warrant was issued three months later. In Nairobi, the discrepancies in the falsified Lucentis were established against genuine Novartis stock: a different brand name on the carton, 0.3mg where the registered strength is 10mg per millilitre, a dark amber vial where the real one is clear glass. Every item on that list requires the genuine article in the other hand.
The brand expert, by post. Taiwanese police photographed the seized Beyblades, checked the packaging for the Japanese-language mark, ran reverse image searches and mailed samples to the authorised distributor for an opinion. The Mexican detection was a manufacturer looking at photographs and judging that the inner and outer packaging were not original. This is the remote version of the same method, cheaper and slower.
The laboratory assay. NAFDAC established that the Jos Coartem contained zero artemether and zero lumefantrine. COFEPRIS recorded failed sterility tests on the Saizen lots. This is the only method in the list that settles the question definitively, and it destroys the sample.
The post-mortem. The San Francisco medical examiner identified a novel synthetic opioid in a sixteen year old’s blood, which is how the counterfeit pill supply was characterised at all. In the DTN60DB cases, the inflator is identified after it has fired.
Physical inspection at a border. CBP officers opened containers in Virginia and parcels at Chicago O’Hare. Worth noting what happened at O’Hare: the officers could not make the determination themselves and the parcels were routed to CBP’s trade specialists for trademark analysis. That is a federal officer, in a facility, with time, referring the question onward.
Serialized traceability. One case. Ford connected a suspect capacitor lot to a printed circuit board serial number and then to a centre stack assembly serial number, and that chain is what turned an unbounded supply problem into a recall of 11,405 specific vehicles.
Now the point. Five of the six methods are available only to institutions, cost money per unit examined, and run after the product has been bought, fitted or injected. The sixth is available before the fact, and it exists only where someone built a serial chain in advance. Nobody in any of these cases was able to check a product at the moment of use, because the only method that works at that moment is the one almost nobody has built.
The auto lane, where both ends of the range are visible
The clearest evidence in the month is a pair of American counterfeit-component cases that sit at opposite ends of the same problem. One had a serial chain. The other does not.
Start with the one that does not. The counterfeit airbag inflators marked DTN60DB are the subject of an NHTSA initial decision and then a final decision dated 29 April 2026, which records ten deaths and two severe injuries across twelve confirmed ruptures in the United States at that point. Repairer Driven News reported on 9 September 2026 that the total had reached eleven deaths and three serious injuries, the eleventh fatality on 27 August 2026 in Dallas, Texas, in a Chevrolet Equinox. The counterfeits sell for as little as $100 against roughly $1,000 for an OEM part.
Now the identification problem, in the agency’s own terms. The final decision identifies the inflator by a DTN60DB marking etched on the inflator cap, and by a label on the electrical connector side carrying a bar code with the number sequence 144415654 666631 or 144415654 666633. The document notes that this connector label remains visible when the inflator is installed in an air bag module. What the final decision does not contain is a list of affected vehicles, and there is no VIN lookup that returns them, because these are aftermarket parts that were never associated with any vehicle identification number in any manufacturer or regulator database. Repairer Driven News put the practical consequence plainly in September: it can be hard to identify DTN airbags while they are still installed in a vehicle, and NHTSA directs owners to technician guidance rather than self-inspection.
So the control is a printed label, read by a technician, on a part that is inside a dashboard. Note also what the manufacturer itself has said. In autoevolution’s coverage of the eleventh death, DTN has claimed that some of the units may themselves be counterfeit, which means the named manufacturer cannot distinguish its own product from imitations of it. There is no layer left to appeal to.
Against that, the Ford case. On 25 September 2026 Ford issued recall 26V605, with service-parts recall 26E065 covering 46 replacement displays, over potentially counterfeit multilayer ceramic capacitors in the SYNC 4 centre-stack display boards supplied by a tier-2 supplier in China, Suzhou Dongshan Display. A cracked capacitor shorts, blows the display fuse and kills both the 10.1 inch screen and the rearview camera feed. The recall covers 11,405 vehicles and Ford estimates 47 percent of them carry the defect, about 5,360 units.
The sentence worth keeping is this one: traceability records connected the suspect capacitor lot to the printed circuit board’s serial number, then to the centre stack assembly serial number. That is the whole difference. Counterfeit components reached an OEM assembly line in both senses, and in Ford’s case the serial chain converted an unknown exposure into a list of 11,405 named vehicles and a remedy programme. In the inflator case, with no chain, the exposure is unknown, the owners are unidentifiable, and the cost of inspection falls on whoever happens to own the car.
The medicine lane, where the paperwork is in order
The counterfeit medicine cases in the month share a feature that makes them harder, not easier, than the consumer-goods cases: the documents were fine.
In Karnataka, the investigation that began with a farmhouse raid at Bidadi in August reached a seventh arrest on 30 September. Cheap bulk drugs were refilled into new vials and relabelled as premium imported brands, and seventeen distributor licences were cancelled with eight suspended, a Pfizer warehouse among the affected establishments. The South First reported that a distributor is suspected of having been used as a front to move counterfeit medicines through the regular licensed pharmaceutical supply chain, and that the drugs include cancer therapeutics. This is not a grey market running alongside the real one. It is the real one, carrying fakes under valid licences, which is precisely the case that wholesaler credentials and paper trails cannot catch.
And ThePrint recorded the detail that matters most for anyone selling verification: the counterfeit labels featured QR or scanning codes which were found to be completely nonfunctional upon verification. The counterfeiters printed the scan-to-verify layer as decoration, because they correctly judged that almost nobody scans, and that a code which is never scanned only has to look like a code.
The DOJ charges announced on 29 September over a counterfeit Ozempic scheme describe the same completeness from the other direction. The product shipped with counterfeit packaging, package inserts, pen labels and needles. Every element a patient or a pharmacist could inspect was reproduced. The scheme ran from July 2023 to April 2024, and FDA had seized counterfeit Ozempic and issued a public warning in December 2023, four months before it stopped. A regulator’s alert is a broadcast. It does not reach the pen in a person’s hand.
Mexico’s regulator showed what happens when the identifier itself is attacked. The COFEPRIS alert of 28 September covers thirteen lots across four products, and the mechanic is that counterfeiters used real lot numbers with reprinted expiry dates, originals dated 2020 to 2024 re-dated to 2026 to 2029, alongside invented lot numbers absent from company records. The alert also notes that the industry, COFEPRIS and the health ministry are studying a QR code to trace each pack. Studying, while genuine lot numbers are already being recycled onto fakes.
And in Jos the laboratory had the final word, as it usually does. Two men and a pharmaceutical company were arraigned on 23 September over counterfeit Coartem containing zero artemether and zero lumefantrine. The case began with a Novartis report and a raid in February 2025. Roughly twenty months from a brand’s tip to a courtroom, in a country with a very large malaria burden, and nothing available to the pharmacist in between. The defendants are charged, not convicted.
When the forged object is the state’s own instrument
The most revealing cases in the month are not the ones where a brand was copied. They are the ones where the thing copied was an official mark of authenticity.
In Meru County, Kenya, NACADA seized thousands of bottles of suspected counterfeit spirits and more than 900 packets of uncustomed cigarettes on 30 September, with three arrests, in a renewed crackdown following a surge in methanol poisoning. The fakes carried counterfeit excise stamps. The excise stamp is the state’s own anti-counterfeiting device, a printed, government-issued token that is supposed to settle the question, and it was the thing being forged. That is the second Kenyan case this autumn with exactly that feature, after an earlier operation involving forged revenue-authority stamps.
Two days later, in a residential homestead at Muthua in Kabete, detectives found the full production kit for counterfeit juice: 1,400 filled bottles, 56 cartons of empties, five packets of caps, two industrial drums, unlabelled chemicals in 50 gram sachets, and then the trust layer, which was office glue, rubber stamps, ink pads, brand stickers and an expired Kenya Bureau of Standards standardization mark certificate. The capital equipment required to counterfeit a national standards mark is a rubber stamp and some glue.
The American version of the same case arrived in a CBP release on 29 September. Across five September seizures at Virginia ports totalling about $856,000, two of the five were counterfeit certification marks rather than counterfeit brands: 1,176 carpet rolls bearing counterfeit OEKO-TEX labels, worth $686,000, and 1,000 ceramic sinks bearing counterfeit UPC Shield certification marks. A mixed container in the same run held ceramic tiles, sound-absorbing panels, garden pots, poker tables and various Land Rover parts. The certification mark is the signal an installer, a specifier and a building inspector all rely on, and it was printed by someone else.
In India on 2 October, Maharashtra’s FDA and the Pune police crime branch seized 430 kg of counterfeit Amul cheese along with a packing machine. Original expiry dates were being removed and replaced with new ones, and counterfeit Amul labels were being applied. That is the COFEPRIS re-dating mechanic appearing in consumer dairy, on one of the largest distribution footprints in the country, executed at a house.
The common lesson is specific and it is not about any one agency. A printed claim of authenticity is a claim, and the cheaper and more widely trusted the claim is, the more worthwhile it becomes to print it yourself. A tax stamp, a standards mark, a certification label, a lot number and a QR code all belong to the same category, and the month produced a forged example of every one of them.
What the platforms and the courts did
Two things moved in the month that are genuinely significant, and neither of them is verification.
The first is platform withdrawal. eBay banned the sale of airbags and inflators on its site, first reported by Repairer Driven News on 14 September and effective on 24 September, when NPR carried it to a general audience. eBay joins Amazon, Meta, Temu and Alibaba in refusing the category. Read the consumer guidance in that coverage and you find it is entirely history-based: check the vehicle’s crash record, ask whether the airbag has been replaced, use a trusted installer. There is no step in any of it that examines the part.
The scale of what delisting is up against showed up in the same period from the other side of the world. Harman, the Samsung-owned audio company, reported removing more than 500,000 illegal JBL product links across Asia Pacific marketplaces during 2025, of which roughly 300,000 were outright counterfeit listings. Half a million removals in one year in one region, and in the first half of 2026 counterfeit Flip 6 and Charge 6 units were still being intercepted in South Korea and at the Thai border, some bearing model names that do not exist. The listing comes down. The unit in the box was never verifiable.
The second thing that moved is liability. On 10 September a judge in the Central District of California denied Walmart’s motion to dismiss in Estée Lauder’s counterfeiting suit, and The Fashion Law reported that the court refused to limit the case to the seventeen test-purchased products and held that Walmart’s role in checkout, payment, support and in-store returns raises liability questions. That is retailer and marketplace exposure for third-party fakes surviving dismissal, which changes the economics for every platform that has been treating counterfeits as a seller problem.
It is worth putting the counterweight beside it rather than only the helpful case. On 13 August 2026 the English High Court held in Shein’s claim against Temu that Temu was not liable, describing its role as merely technical, automatic and passive and finding that the hosting defence would have applied. That case concerns copyright in product photographs rather than counterfeits, but the direction is opposite, and two major jurisdictions are currently moving apart on platform responsibility. Anyone arguing that the law is settling in favour of liability is overstating it.
And even where liability lands, notice what it produces. A retailer found liable for third-party counterfeits has a strong incentive to police its sellers, audit its supply and settle claims. None of those is a method for checking a product, and the test purchase, which is how Estée Lauder built its case in the first place, is the brand-expert method again, priced per unit.
What the regulators built
Three pieces of state machinery advanced in this period, and all three are real. None of them closes the gap described here, and it is worth being exact about why.
In Europe, the Digital Product Passport framework reached completion at the standards layer. Six horizontal standards were published on 27 May 2026 and cited in the Official Journal on 15 July by Implementing Decision (EU) 2026/1736, conferring presumption of conformity with Articles 10 and 11 of the Ecodesign for Sustainable Products Regulation. The remaining two, on access rights and on data authentication, were published by CEN and CENELEC in September, and an implementation review last updated on 21 September records that no Official Journal citation of either had appeared as of 20 September. The Registry has been in production since 20 July.
That is a serious piece of infrastructure delivered fast. What it does is make passport data trustworthy. The authentication standard defines signed data constructs so that any party can check a passport came from the operator it claims and has not been altered, which is a guarantee about a record. The carrier standard permits a printed QR code just as readily as an NFC chip and is explicitly scoped away from cryptographic security. So a counterfeiter who copies the carrier gets a genuine, correctly signed passport describing a product that is not in the box, and nothing in the eight standards asks the question that would catch it.
In the United States, Congress legislated in exactly the direction this argument points, for one narrow object. The Stop Pills That Kill Act passed the House unanimously and mandates serialization of pill presses and key components, criminalising the removal of identifiers. Marking the physical machine, with a serial that is an offence to remove, is a recognition that paper controls on a dangerous object do not work. The object chosen is the press, not the pill.
And USTR has named the problem in its own words. The 2026 Review of Notorious Markets for Counterfeiting and Piracy, requested in the Federal Register on 26 August 2026, states an issue focus on high-quality counterfeit trademark goods known as superfakes or superclones, with initial comments due 7 October and rebuttals 21 October under docket USTR-2026–0529. A superfake is by definition a counterfeit that defeats visual and documentary inspection. The United States Trade Representative is asking the public for evidence about fakes that cannot be told apart by looking, which is the premise of everything above, stated by the government rather than by a vendor.
The objections
There are four serious arguments against reading the month this way, and they deserve better than a dismissal.
The record is selected by what gets reported. This is the strongest objection and it is partly right. A case only enters the table if a journalist wrote it up with enough detail to show how the fake was identified, and the cases that reach the press skew towards large seizures, deaths and prosecutions. There is no visibility here into the counterfeits caught quietly at a goods-in bay, nor into the ones never caught. The claim this piece makes is therefore narrower than it may read: among cases with published detection detail, lab and expert comparison dominate. It is not a measurement of all detection everywhere.
Enforcement is working, and the cases prove it. Also true. Every case in the table is a detection system succeeding. NAFDAC ran the assay and built a prosecution. Kenya’s Pharmacy and Poisons Board caught falsified Lucentis in routine post-market surveillance rather than after a wave of harm, and had someone in custody within days. CBP opened the containers. A medical examiner in San Francisco identified a compound barely in the literature. The argument here is not that these institutions are failing. It is that all of them operate either upstream of the product or downstream of the harm, and none can be present at the moment of use.
Unit-level verification can be defeated too. Correct, and anyone selling it as unbreakable is lying. A chip can be harvested from a genuine unit and reapplied, a reader can be spoofed, a database can be wrong, and a verification app the buyer does not open is worth exactly as much as the unscanned QR codes in Karnataka. The relevant comparison is not perfect against imperfect. It is what a buyer can check in five seconds against what currently requires a laboratory, and how much a counterfeiter has to spend to defeat each.
The counterfeits that kill people are not the ones verification addresses. This is the fairest objection to the pharmaceutical material. Nobody dying from a counterfeit street pill was going to authenticate it, because it was never a genuine product and no authentication layer exists on a fake. Verification does not touch the illicit drug supply. Where it does bear is the other set of cases in the same month, the ones where fakes moved through pharmacies, clinics, licensed distributors and retail shelves as genuine licensed product. Those are the Nairobi, Jos, Karnataka, Pune and Kabete cases, and in those the buyer had every reason to expect the real thing and no way to establish it.
What would have to change
If this pattern is going to break, it breaks at the point where a claim about a product stops being something printed on it. Three things would show that happening, and none of them has happened yet.
The first is a rule that specifies the assurance level of the link between a product and its record, rather than the format of the record. Europe has now specified identifiers, carriers, exchange, storage, interfaces, interoperability, access control and data authentication. It has not specified how confident anyone should be that a given carrier belongs to a given physical unit. Until some standard owns that question, a compliant passport and a counterfeit product remain compatible.
The second is serialization reaching the dangerous object rather than the machine that makes it or the pallet it ships on. The Ford recall is the proof of value, and the pill press legislation is the principle conceded. An airbag inflator, a vial, an ampoule and a brake pad are all objects where a serial that cannot be forged would turn an unbounded recall into a list. The inflator case is the cleanest demonstration available of what its absence costs: eleven deaths, and no way to find the cars.
The third is a brand deciding that it is cheaper to let the buyer check than to keep paying for test purchases. That calculation is already visible in the record, if anyone is adding it up. Three months of brand-funded test purchases in Gqeberha. A distributor opinion by post in Taipei. A manufacturer reading photographs for Mexico. Two Novartis reports behind two different cases on two continents. Half a million delistings by Harman in a single region in a single year. Brand owners are already the detection system of last resort, and they are paying for it in investigation hours, laboratory time and legal process, after the product has been used.
Until one of those three moves, the position is the one the month describes. The fakes are being found. They are being found late, by experts, in laboratories, on behalf of institutions, and never by the person holding the product.
What to do, by who you are
Before the recommendations, the thing this piece is not saying. No rule anywhere requires a chip. Europe’s carrier standard permits a printed QR code and that satisfies every DPP obligation in force. Nothing in the record above shows that the agencies are incompetent, and most of it shows the opposite. And compliance and proof remain two different problems: a product can be correctly registered, accurately labelled, properly batch-numbered, carried on a compliant data carrier, and still be a counterfeit.
If you are a regulator or an enforcement agency. The batch alert is the instrument you have and it is worth publishing fast, as Kenya did. Say internally what it is, though, because clinicians will not: a batch alert is a recall mechanism, and it assumes the number on the carton is trustworthy, which the Mexican case shows is no longer safe to assume. Where you have authority over the carrier rather than only the record, that is the lever nobody is pulling.
If you own a brand. Add up what detection cost you last year, in test purchases, lab referrals, distributor opinions, delistings and legal process, and compare it with what it would cost to make the product checkable by the person buying it. You are funding the detection system either way. The question is whether you fund it before the product is used or after.
If you are a dealer, distributor or installer. The Ohio dealership owner who pleaded guilty on 18 September to trafficking counterfeit airbags imported as desktop night lights is the warning, and the California salvage-inspection business whose licence was suspended for issuing fifteen certificates of compliance with no inspection performed is the second one. Criminal and licensing exposure is now landing at the point of installation, and history checks are the only verification tool anyone has handed you. Ask your suppliers what you are supposed to inspect, and write down the answer.
If you are a clinician or a pharmacist. In at least three of the month’s cases the paperwork was in order and the product was not. A valid licence, a registered name and a plausible batch number are the things a counterfeiter now reproduces first. When something looks wrong physically, that instinct is currently the most sensitive instrument in the chain, and it is the one that caught the Thai cough syrup when a company representative noticed the sticker colour.
If you run a platform. Delisting at Harman’s scale, half a million links in one region in one year, is the measure of what the approach costs and what it does not achieve. The listing is not the product.
Aeroz` builds product verification and connected product infrastructure.
Aeroz, Making Authenticity Checkable. Visit aeroz.io to learn more & get in contact with our team via [email protected].
2026 Aeroz all rights reserved.