Earlier this year, a client reported a very smooth scam. Someone called the pharmacy and represented to be a California Board of Pharmacy inspector who was investigating an anonymous complaint against the pharmacy. The so-called “inspector” asked the pharmacy to provide its account number with Cardinal, which the pharmacy staff did. The scammer then contacted Cardinal and placed a large order for Invokana (the cost of around $90,000). The pharmacy received the order the next day.
Now the scammers called the pharmacy and introduced themselves as representatives from Cardinal. The “representative” explained that Cardinal made an error and erroneously shipped Invokana. They apologized and stated that their driver would arrive shortly to collect the erroneous shipment. For some fortunate reasons, the owner of the pharmacy called Cardinal with a follow up question and learned that the order was placed the day before and that no one from Cardinal called to arrange the collection. The owner of the pharmacy described the “scammer” to be very believable, who definitely knew the industry. (I am still wondering why the driver was not apprehended).
I thought that this was a stand-alone incident. Last week, however, the California Board of Pharmacy issued a Fraud Alert to all pharmacies describing a similar scam scheme:
“Pharmacies, hospitals, and distributors are being warned about scammers using sophisticated techniques to obtain account numbers and other sensitive information and unlawfully divert quantities of pharmaceutical goods in transit. In some cases, scammers pretended to represent the state’s board of pharmacy or employees for a particular distributor or pharmacy.
The callers requested and obtained each pharmacy’s DEA number and account purchasing information for their principal distributor. The scammers then called each distributor – pretending to be the pharmacy – and ordered between $100,000 and $300,000 worth of products. Common products ordered included a variety of HIV medications (Descovy, Triumeq, Odefsey) and Xarelto, Otezla, and Eliquis.
Once the products were delivered, the scammers called the pharmacy – pretending to be the distributor – and advised the pharmacy the order was made in error. The scammers then arranged for a courier to pick up the diverted product.”
The Board directs the pharmacies to the Healthcare Distribution Alliance Pharmaceutical Cargo Security Coalition’s (“Coalition”) report on the issue, which discusses methods being used to divert drug shipments and tips for protecting distributors and pharmacies. We highly recommend that your staff reads the report to be able to identify similar scams.
The report describes several phishing techniques targeting pharmacies:
– scammers represent themselves as Board of Pharmacy representatives asking for wholesaler account information stating that they need it for recall purposes
– scammers may pose as a manufacturer, informing the pharmacy that certain products must be replaced and a credit will be issued through the original wholesaler. The scammer then requests the pharmacy’s account information with the wholesaler in order to issue such a credit.
– scammers may also pretend to be a wholesaler representative and request the pharmacy to update its payment method by providing a new wire account.
The report explains that scammers are often females, very believable and often speak of some urgency or with authority.
The Coalition in its report recommends the following tactics to avoid potential phishing techniques:
- Validate anything thought to be a suspicious email address: verifyemailaddress.org.
- Ensure any business phone number and/or address you are provided, in any type of account or credit modification/application matches a Yellow Pages “Reverse Lookup.”
- Ask the caller for their name and phone number, hang up and call your wholesaler, manufacturer, or the Board of Pharmacy directly, requesting authentication.
- All staff should be instructed not to share any confidential information with anyone calling into the pharmacy. It is important to remember that a distributor/manufacturer/Board will rarely, if ever, call you to request this type of private information.
- Verify all orders. If you see an order that you haven’t placed, then fraud is likely.
- Confirm wire payment requests before making any payment.
- The only person that should be permitted to pick up returns should be your wholesaler’s driver. Call your wholesaler if anyone, other than your regular driver/company, visits your site to pick up and process any return.