Originally published on Medium.
On August 18, drug inspectors in Karnataka raided a distributor in Bidadi, about 30 kilometres outside Bengaluru. Behind the storefront they found an unlicensed repackaging unit stocked with filling machinery, printing equipment and empty vials. The operation, according to the state, bought low-cost medicines in neighbouring states, refilled them into new vials and relabelled them as expensive multinational brands. Those vials were cancer drugs and critical-care injections, and nearly 90 hospitals and clinics received them.
The seized stock shows exactly what was being faked. Investigators recovered 264 vials labelled as Emblaveo, a reserve antibiotic used against drug-resistant infections, often in intensive care. Alongside them were 5,640 vials labelled as Cefiavigent under another company’s name and 1,531 injectables labelled as Hizlam under a third. Three brands from three different companies were forged in the same room. This was not an attack on any one manufacturer. It was a relabelling business, and it used whichever brand names would sell.
Consider what that means at the bedside. A reserve antibiotic is what a doctor reaches for after other antibiotics have failed, and officials describe the counterfeit vials as containing “no active medicinal components, the wrong ingredients, or toxic substances.” A patient who receives one is, in effect, untreated at the moment they are sickest.
On September 20, the Karnataka Food and Drugs Administration published the outcome. It cancelled sixteen drug licences and suspended at least eight more, including the licence of a multinational’s carrying-and-forwarding depot near Nelamangala. The state’s health minister says that suspension was over alleged non-cooperation with the investigation, not involvement in the counterfeiting. Drugs, machinery and printing materials worth ₹5.05 crore were seized, and by September 22 investigators said they suspected around ₹12 crore of counterfeit medicine had been sold to hospitals and clinics since early 2025. Five people have been arrested. The alleged ringleader is in Azerbaijan, where extradition is being pursued, and the investigation now reaches into Maharashtra and Gujarat.
Buried in the regulator’s findings is one line that deserves to be read slowly. The forged labels “featured QR/scanning codes, which were found to be completely nonfunctional upon verification.”
The counterfeiters printed a QR code on the box because genuine boxes carry one. Nobody in the supply chain scanned it until investigators did.
The warning the public got
Here is the official advice to patients, as published: “Purchase medicines only from licenced pharmacies against valid tax invoices and report suspicious packaging or non-scanning QR codes.”
Now read it from the patient’s side. The first instruction is to trust the pharmacy, yet these drugs reached reputable hospitals through a chain that included licensed distributors. The second is to trust the invoice, yet the operation produced invoices too. The third is to scan the code, and the code only failed because this particular counterfeiter did not bother to make it work.
The next one will.
The same finding, four countries, one month
Karnataka is not an isolated case. Within a few weeks, regulators and police on three continents published the same discovery.
In Nigeria, NAFDAC issued a warning on September 18 after intercepting a counterfeit antimalarial, artemether/lumefantrine 80/480 mg, at the Coordinated Wholesale Centre in Kano. The pack claimed manufacture in India under batch BP5203, and the giveaway was the registration number printed on it: “02 3457.” That number does not exist in NAFDAC’s database. The authentication mark was a printed number, and it took a regulator with database access to notice it was fake.
In Indonesia, police in Bandung reported on September 10 that they had seized 6,624 bottles of alcohol carrying suspected fake tax stamps. The police chief described the method plainly: “The original excise stamps were peeled off, and the suspect then printed new ones.” A July haul in Bali had already taken 19,142 bottles worth about $711,000.
In Kenya, a national sweep from August 20 to 31 produced 11 arrests, more than 4,000 suspected counterfeit products and 240 beverages carrying fake excise stamps in a single Nairobi neighbourhood. Kenya already has a consumer app for verifying excise labels, yet coverage of the sweep said outright that “taste, smell, label or barcode alone cannot conclusively establish counterfeiting.” The Kenyan Senate is now weighing a digital traceability plan that explicitly rejects QR-only verification, because counterfeiters clone codes and refill genuine bottles.
And in Karnataka, on September 20, a regulator confirmed that the QR codes on forged hospital drugs did not work at all.
Four markets and four product categories point to one pattern. Every authentication mark that is printed has already been printed by someone else.
Why printed marks lose
A printed code is information sitting on a surface, and anything that can be seen can be copied. A good counterfeiter copies it exactly. A working clone of a real code scans perfectly because it is the real code, only now it sits on a thousand boxes instead of one.
That is the failure the Kenyan Senate is describing. A code tells you that a code exists. It does not tell you that this box is the box the code was issued to. Serialised QR programmes try to close that gap by flagging any code scanned twice, but the fix only works if the genuine product is scanned first, if someone actually checks the flag, and if the counterfeiter has not simply harvested codes from genuine packs thrown away after use.
What the Karnataka case adds is sadder still. The code did not even have to be good. It only had to be present, because in practice nobody along the chain was scanning. An estimated ₹12 crore of counterfeit medicine moved through licensed distributors and into hospital wards carrying a code that did not work.
Where regulators are heading
Not every response has been another hotline. On September 15, Thailand made injectable GLP-1 weight-loss drugs prescription-only, and its FDA named counterfeit products as one of three reasons. The rule comes with a mandated track-and-trace system: licensed importers and sellers must report so that each medicine can be followed “from importation through storage and distribution to dispensing to patients.”
South Korea’s customs data shows why regulators are moving. Officers seized 5,030 obesity-drug shipments through August 2026, compared with 1,189 in all of 2025. When labs tested counterfeit Mounjaro from those seizures, they found uneven doses, unidentified impurities and no cold chain.
Traceability rules like Thailand’s point in the right direction, but they still depend on the carrier. A track-and-trace system that follows a printed code will follow a cloned code just as faithfully.
The Aeroz Angle
Aeroz replaces the printed mark with a chip. Each unit, whether a vial, a pen or a bottle, carries a secure NFC tag that returns a cryptographic response tied to that one unit when tapped with an ordinary phone. You can photograph a chip, but you cannot print one, and copying what it says out loud does not reproduce the key behind it.
That turns the Karnataka advisory’s “report non-scanning QR codes” into something a patient, pharmacist or ward nurse can actually act on. Verification happens at the point of use: a nurse taps the vial before administering it, which takes seconds and needs no database login and no regulator in the room. A cloned identity fails on the first tap rather than waiting for a second scan to raise a duplicate flag, because the copy cannot answer the challenge. Refills are caught as well. Tamper-evident tags break when a vial or bottle is opened, so a genuine container refilled with something else no longer verifies, which is precisely the refill fraud that Kenya, Nigeria and India are all describing. And rules like Thailand’s become enforceable at the unit level, because track-and-trace finally has something real to trace: a thing that cannot be duplicated.
Printed marks were a reasonable answer when counterfeiters could not print well. They now print well enough to get into ICU wards, so the mark has to move from the surface of the box into the box itself.
The deadline is not on a calendar.
This piece is part of an ongoing series on counterfeit medicine and the systems meant to catch it. Follow to get the next one.