Originally published on Medium.
PIP, Takata and Ranbaxy were the same failure. 67 million airbags, and none of it counts as counterfeiting.
Stimwave sold doctors a neurostimulator component called the White Stylet. It was plastic, it contained no copper, it could not receive anything, and on June 17, 2024 its creator was sentenced to six years for it.
This series has written thirty-nine pieces on the assumption that the counterfeiter is an outsider. Somebody who is not the manufacturer makes a thing that pretends to be the manufacturer’s. Every mechanism we have examined, printed codes, serialized barcodes, cryptographic tags, state verification marks, is built to answer that one question: did this come from who it says it came from.
The White Stylet did. That is the whole problem with it.
What the device was
The StimQ PNS System is an implantable neurostimulator for intractable chronic pain, producing electrical current to target peripheral nerves outside the spinal cord. It had three parts: an implantable electrode array called the Lead, an externally worn battery, and a receiver.
The receiver was the Pink Stylet. In the words of the sentencing release from the U.S. Attorney for the Southern District of New York on June 17, 2024, it “acted as an antenna, transmitting energy from an external power source to the Lead.” It contained copper. It was about 23 centimetres long, and that length was a problem: physicians told Stimwave they were having trouble implanting it in certain patients, and it could not be cut shorter without affecting its function as a receiver.
So a genuine engineering constraint produced a genuine commercial problem. A device that does not fit a patient does not get implanted, and a device that does not get implanted does not get billed.
The part that was built to be billed
What Stimwave produced in answer was the White Stylet.
The sentencing release describes it as “a dummy component made entirely of plastic.” It “contained no copper, and therefore had no conductivity.” It was marketed as a receiver, but “it was made of plastic and could not function as a receiver.” And it solved the fit problem perfectly, because it “could be cut to size by the doctor for use in smaller anatomical spaces.” A thing that does nothing can be trimmed to any length without loss of function.
The release is blunt about why it existed. The White Stylet was “created solely so that doctors and medical providers would continue to purchase the Device.”
The economics are in the same document. Stimwave sold the device to doctors for approximately $16,000. Implanting the Lead was reimbursable at roughly $4,000 to $6,000. Implanting a receiver was reimbursable at roughly $16,000 to $18,000. Then U.S. Attorney Damian Williams said doctors could bill Medicare and private insurers “approximately $18,000 for each implantation of that dummy component.”
Read that sequence again, because it is the mechanism. The fake was not built to fool a buyer into thinking they had bought something better. It was built so that a billing code would fire. The target was not the supply chain. It was the reimbursement schedule.
The scheme ran, per the release, “From at least in or about 2017 up to and including 2020.” Laura Perryman, Stimwave’s founder and then chief executive, was convicted after a two-week trial before U.S. District Judge Denise L. Cote of health care fraud and conspiracy to commit health care fraud and wire fraud, and Judge Cote sentenced her to six years in prison and three years of supervised release.
Genuine by every test this series applies
Now put the White Stylet through the checks.
Was it made by the company named on it? Yes. Stimwave made it. Did it ship through the authorised channel? Yes. Was it invoiced by the manufacturer of record, in the manufacturer’s packaging, with the manufacturer’s documentation? Yes. Would a serial number resolve to a real record in a real manufacturer’s database? Yes, because the manufacturer issued it. Would a cryptographic tag bound to the unit at the point of manufacture return a valid response? Yes, because the party doing the binding was the party doing the fraud.
Every identity mechanism this publication has described over thirty-nine articles returns the same answer on this part, and the answer is authentic. The answer is also correct. The part really was a genuine Stimwave White Stylet.
It was also a piece of plastic implanted in a human being under the representation that it was a receiver.
Here is the structural reason, and it is not specific to Stimwave. Every verification system in this field is a trust propagation system: it takes an assertion made at the point of manufacture and carries it, intact and tamper evident, to the point of use. The cryptography is excellent. What it protects is an assertion, and the party making the assertion is the manufacturer. The root of trust in every one of these architectures is the company that made the thing. When that company is the adversary, nothing downstream is compromised, because nothing downstream needs to be. The system works perfectly and propagates a lie with full integrity.
This is not a rare failure
It would be comfortable to file Stimwave as an oddity, one bad executive in one small company. The record does not allow that.
Poly Implant Prothèse. The French manufacturer filled silicone breast implants with a gel other than the one it had declared. The EU’s own scientific committee found the company “fraudulently made use of low-quality material (industrial silicone)” and that the silicone differed from “the one it had declared in the documents submitted for conformity assessment.” The implants had been CE marked in October 1997 under the supervision of the notified body TÜV Rheinland, as the UK Department of Health’s 2012 report on the affair records, and the same report concludes that PIP “deliberately concealed their use of a non-approved filler material.” The European Parliament’s resolution of 14 June 2012 put around 400,000 PIP silicone implants sold worldwide, and said plainly that “the overall number of women who have received implants is unknown.” Jean-Claude Mas, the founder, was convicted of aggravated fraud in Marseille on 10 December 2013 and sentenced to four years, upheld on appeal in 2016.
Takata. In the statement of facts attached to its 2017 guilty plea in the Eastern District of Michigan, the company admitted that from about 2000 to about 2015 it fabricated, removed and altered test data in validation and lot acceptance reports, concentrating on ballistic output and effluent gas, the two measures its ammonium nitrate inflators could not meet. Employees had a word for stripping out unfavourable results. They called it “XX-ing” the data. The DOJ’s fraud section chief said the company “repeatedly and systematically falsified critical test data related to the safety of its products.” Takata pleaded guilty to wire fraud and paid $1 billion, comprising $975 million in restitution and a $25 million fine. NHTSA’s recall page, as published and read on 9 November 2026, states that approximately 67 million Takata airbags have been recalled in the United States and that it has confirmed 28 deaths in this country.
Ranbaxy. On 13 May 2013 the generic manufacturer’s US arm pleaded guilty to seven federal felonies, three under the Food, Drug and Cosmetic Act relating to adulterated drugs and four for knowingly making material false statements to the FDA, and the group paid $500 million. The false statements concerned stability testing for named antibiotics: tests reported to the agency as months apart had in some cases been run on the same day or within days of each other, and samples awaiting testing sat in a refrigerator that was not an approved stability chamber, which the FDA was not told.
Three different industries, three different decades, three different fraud mechanisms. One structural feature in common. In every case the product was made by the company whose name was on it, shipped through the authorised channel, and accompanied by correct and genuine documentation. Every provenance check in existence would have passed every one of them, and in PIP’s case a notified body audit actually did.
Not one of them was caught by a check on the product
Follow how each came to light, because the pattern is the point.
PIP was found by an unannounced regulatory inspection of the company’s premises on 16 to 18 March 2010, following a surgeon’s alert and a rise in device incident reports. Ranbaxy was brought down by a whistleblower, Dinesh Thakur, who received about $48.6 million of the federal recovery. Takata’s falsification surfaced through field ruptures, congressional scrutiny and a criminal investigation. And for Stimwave, as far as the public record goes, nobody has said at all: neither DOJ release names a whistleblower, a qui tam action, an FDA inspection or an internal audit, and the only physician reporting sentence in either document concerns the fit of the genuine part rather than the existence of the fake one.
Inspection, whistleblower, investigation, unknown. Not one of these four was caught by examining the product, scanning a code, checking a serial, or auditing a chain of custody. Every one was caught by a person with access, or by a body with subpoena power, or by bodies failing in the field. This is the single most uncomfortable fact in this article, and it is also the most useful one: the detection mechanisms that actually work against insider fraud are the ones nobody is selling, and the ones being sold would not have helped.
And none of it counts as counterfeiting
Now the part that makes this a measurement problem rather than an anecdote.
The headline figures everybody quotes for product fraud are trade based, built from cross border flows of infringing goods: the EUIPO and Commission detention data this publication reported on in October, the OECD’s estimates, customs seizure totals. We have used those numbers ourselves and they are the best available for what they measure, which is an outside party moving goods that infringe somebody else’s rights. A licensed manufacturer shipping its own out of specification product under its own name, through its own authorised distributors, infringes nobody’s trademark. It is not counterfeit in the legal sense that the measurement apparatus uses. So it is not merely under counted. It is outside the count by construction.
PIP appears in no counterfeiting statistic. Neither does Takata. Neither does Ranbaxy. Neither does the White Stylet. Four cases, at least 67 million recalled airbags, around 400,000 implants sold, $1.5 billion in criminal and civil resolutions between two of them, and a figure of zero in every chart the industry puts on a slide about the scale of the problem.
We went looking for any published estimate of how often product fraud originates with the authorised manufacturer rather than an outsider, across the OECD and EUIPO illicit trade work, the food fraud literature and the standard typologies. The typologies name insider origin fraud as a distinct category. None of them measures its share. As far as we can establish, no published estimate exists.
That absence is the reason this is not a niche concern. An entire regulatory and commercial apparatus, DSCSA, the EU Falsified Medicines Directive, digital product passports, the GS1 2D migration, national verification marks in Kenya and Pakistan and India, is being built to address a threat model that is measured, funded and understood. Running alongside it is a second threat model that produces some of the largest product safety events on record, that no instrument in the first apparatus can detect, and for which nobody has a number.
Why the insider version is the cheaper attack
Set the two side by side as an economic problem, because that is how the person doing it sees it.
An outside counterfeiter has to acquire the product, reproduce the packaging, forge the identifiers, build a distribution route, and keep all of it away from the brand, customs and the platforms. That is real capital and real operational risk, and it is why enforcement, for all its limits, has some purchase on it.
An insider changes a specification. The tooling exists, the staff are employed, the channel is already open, the customers already have purchase orders, the documentation generates itself, and every control in the chain is designed on the assumption that this party is telling the truth. There is no smuggling, no forgery, no parallel distribution, no border.
And the dwell times show it. Takata admitted roughly fifteen years of falsified data. PIP’s implants were on the market from 2001 and the substitution was not established until an inspection in 2010. Stimwave’s White Stylet ran from about 2017 through 2020. Outside counterfeiting rings get rolled up; insider fraud tends to run until somebody inside talks or something starts failing in the field.
Nobody has published how many people have one
Back to the specific case, and to an absence that should bother everybody who works on this.
Neither the indictment release of March 9, 2023 nor the sentencing release of June 17, 2024 states how many patients received a White Stylet. Not an estimate, not a range. Both say only that Perryman caused doctors and medical providers to implant it into patients, and Williams referred to “the patients who were implanted with that piece of plastic.” Neither release describes any patient’s outcome, and neither mentions explant or revision surgery. We could not find a published number anywhere.
Three years of implants at up to $18,000 a procedure, and the public record does not say how many people are walking around with a non-conductive plastic rod where a receiver was supposed to be. The European Parliament said the same thing about PIP in 2012: the number of women is unknown. Fourteen years apart, two insider frauds, the same missing figure, and in both cases it is the only figure a patient actually wants.
The FDA is almost absent from both Stimwave releases. Neither mentions the device’s clearance status, nor whether the White Stylet fell within whatever clearance the StimQ held. Trade reporting disagrees even on the clearance date, August 2017 against 2016, and we assert neither.
What we are not saying
We are not saying most product fraud is committed by the manufacturer of record. We have no basis for that claim and neither does anybody else, which is the point of the measurement section above. Outsiders copying somebody else’s product remain the most common case in this catalogue and in the enforcement record.
We are not saying identity verification is pointless. A mechanism that defeats outsiders is worth having against outsiders, which is most of the cases. The claim we are retiring is narrower and more important: that a verified unit is a safe unit. It is not. A verified unit is a unit from the party it claims to come from, and that is all it is.
We are not saying the doctors were at fault. The release says they were caused to implant it unwittingly, and the government’s case was that they were deceived about what the component did.
And we are not saying our own field would have caught this. It would not have. Not partially, not with better cryptography, not with a richer data carrier. Everything we build attests to origin, and the origin was real. This is the clearest case in thirty-nine articles of a failure mode our category cannot address, and a vendor who tells you otherwise is selling you something that does not exist.
Who meets this problem
The surgeon who asked a manufacturer whether a component could be cut to size, got a yes, and was telling the truth to the patient as far as anything available to them could establish.
The hospital value analysis committee whose supplier qualification file was complete, current and accurate the entire time.
The payer processing an $18,000 claim under a code for a receiver, with every upstream document in order.
The notified body or auditor who signed a conformity assessment against a technical file that described a product the company had stopped making.
The patient who consented to an implant and has no way to find out, today, which stylet they received.
And every quality lead who has been told, by somebody in our industry, that unit-level verification closes the authenticity question.
If you are one of these people
If you buy implantable devices. Separate the two questions in your own paperwork. Provenance is answerable at receiving. Conformity is answerable only by specification, testing, or an independent party, and no amount of serialization substitutes for it. If a supplier’s answer to “does this part work” is “it is genuine,” that is a non sequitur, and it was the non sequitur at the centre of this case.
If you are a payer. A reimbursement code is a target. The White Stylet existed because a code paid $16,000 to $18,000 for implanting a receiver and nothing downstream tested whether a receiver had been implanted. Codes that pay for a function rather than a procedure need a way to establish the function.
If you run an audit or conformity assessment programme. PIP passed CE marking under a notified body’s supervision and concealed the filler from it. A document based audit against a technical file tests whether the file is consistent, not whether the factory is following it. Unannounced inspection and independent sampling are the controls that found PIP, and they are the expensive ones.
If you are a regulator. The number of patients who received this component is not in the public record of a case that ended more than two years ago. That is a publishable number and it would be worth publishing. The same is true of the insider share of product fraud generally, which nobody appears to have measured.
If you sell verification, including us. Say out loud where the product stops. Ours stops at the manufacturer’s own intent. A tag issued by the party committing the fraud verifies the fraud, and any claim that an authenticity layer makes a device safe is false. Sell it as what it is, a provenance control, and let people buy conformity controls separately, because they are a different product.
What would have had to be provable
For anybody to have caught the White Stylet at the point of care, the provable thing was never going to be where it came from. It came from Stimwave, and that was true all the way down.
What would have had to be provable, at the item, was what it contained and what it did. Whether a given rod carried a conductor. Whether the thing being billed as a receiver could receive. That is a conformity question, answerable by specification and by testing, and it belongs to a different discipline from the one we work in.
Which leaves the industry this publication belongs to with an uncomfortable summary, and it is worth stating without softening. We have built a decade of mandates, standards and products to answer whether a thing came from who it says. Four of the largest product safety frauds on record would have passed all of them, none was detected by any of them, none appears in any statistic measuring the problem, and nobody has counted how often it happens. The counterfeiter is usually outside. Occasionally the counterfeiter signs the certificate, and when that happens, every instrument we have built points the wrong way.
Aeroz, Making Authenticity Checkable. Visit aeroz.io to learn more & get in contact with our team via [email protected].
© 2026 Aeroz. All rights reserved.