The DEA has identified large-scale illegal schemes that generate fake electronic prescriptions for controlled substances by exploiting vulnerabilities in e-prescribing software. Tens of thousands of fraudulent controlled-substance prescriptions have been filled by pharmacies across the country. In these schemes, the clinicians whose names appear on the fake e-scripts did not know their identities and DEA credentials were being used to generate the prescriptions.

How the Fraud Works

Electronic prescription fraud for controlled substances exploits the trust pharmacies place in prescription data transmitted through e-prescribing networks. The schemes generally involve:

  • Stolen or borrowed clinician identities. Fraudsters obtain the names, DEA registration numbers, NPI numbers, and state license information of real, licensed practitioners — without those practitioners' knowledge or consent.
  • Exploited e-prescribing software vulnerabilities. Weaknesses in e-prescribing platforms allow bad actors to inject fraudulent prescriptions into the transmission stream, making the fake scripts appear to originate from a legitimate prescriber's system.
  • Controlled substances across schedules. The fraudulent prescriptions cover Schedule II through Schedule V controlled substances — including opioids, stimulants, and benzodiazepines.
  • Volume at scale. Because the scheme operates through software rather than individual forgery, tens of thousands of fake prescriptions can be generated and transmitted before the fraud is detected.
  • Filled without prescriber verification. Pharmacies that dispense without verifying the prescriber's identity or confirming the prescription through independent channels become the last — and often only — checkpoint that could have stopped the fraud.

What Pharmacists Must Verify

Under DEA regulations, pharmacists bear a corresponding responsibility for every controlled substance they dispense. That responsibility requires taking affirmative steps when a prescription raises questions about its legitimacy. For e-prescriptions in particular, verify the following before dispensing:

  • Prescriber identity — call the office on file, not the number on the script. Fraudsters may embed a phone number they control in the fake prescription. Look up the prescriber's office phone number independently (state licensing board, DEA registration lookup, or the practice's publicly listed contact) and call that number to confirm the prescription was actually generated by that provider.
  • DEA registration validity. Confirm that the prescriber's DEA registration number is current and valid using the DEA Diversion Control Division's online registration verification tool. A legitimate-looking DEA number is not the same as a valid, active registration.
  • Prescriber-patient relationship. For controlled substances, there should be an established patient-provider relationship. A new patient presenting a high-quantity Schedule II prescription from a prescriber outside your normal service area warrants heightened scrutiny.
  • Prescription channel and origin. Scripts arriving through unusual channels — transmitted by a third party rather than directly from the prescriber's system, or printed and presented as if electronic — are a red flag requiring independent verification.

Red Flags Checklist

  • New patient presenting a high-quantity Schedule II controlled substance prescription
  • Multiple new-patient prescriptions from the same prescriber arriving within a short period
  • Prescriber location is distant from your pharmacy's service area without an obvious referral context
  • Phone number on the prescription does not match the prescriber's publicly listed office number
  • DEA number does not verify as current and active in the DEA registration system
  • Prescription arrives through an unusual or unexpected transmission channel
  • Patient is unable to describe the clinical encounter that generated the prescription
  • Prescriber specialty is inconsistent with the drug prescribed (e.g., a podiatrist prescribing high-dose opioids for a non-musculoskeletal complaint)

What to Do If You Suspect Fraud

If a prescription raises red flags consistent with e-script fraud:

  • Refuse to fill. A pharmacist who has reason to believe a prescription was not issued for a legitimate medical purpose is not required to fill it — and dispensing it may expose the pharmacy to liability under the corresponding responsibility doctrine.
  • Document everything. Record the prescription details, the red flags observed, the steps taken to verify (including who you called and what they said), and your decision not to dispense. Thorough documentation protects the pharmacy and supports any subsequent investigation.
  • Notify the DEA. Report suspected fraudulent controlled substance prescriptions to the DEA by submitting a tip through the DEA Diversion Control Division. Prompt reporting helps investigators identify the scope of an active scheme before more prescriptions are filled.
  • Alert the prescriber whose name was used. The prescriber listed on the fraudulent script is a victim too — they may not know their identity is being used. Contact their office through independently verified contact information to notify them.

Why This Matters for Diversion Prevention

Fake e-scripts are a diversion vector: controlled substances obtained through fraudulent prescriptions enter the illicit market, not legitimate patient care. When a pharmacy fills a fraudulent prescription, it becomes an unwitting link in a diversion chain — and potentially a target in subsequent DEA enforcement action.

The corresponding responsibility doctrine means pharmacists cannot rely solely on the apparent legitimacy of a prescription's format or transmission channel. The obligation to ensure a controlled substance is dispensed for a legitimate medical purpose rests on the dispensing pharmacist, not just the prescribing clinician. E-script fraud is designed to exploit format-based trust; independent prescriber verification is the countermeasure.

Further Reading

For a full list of behavioral and documentation red flags that suggest a prescription may not be legitimate, see the 15 Red Flags of Drug Diversion guide. The Corresponding Responsibility Guide covers the pharmacist's independent obligation in detail, including how courts have applied the doctrine in enforcement cases. For broader context on e-prescribing fraud and other current diversion vectors, see Diversion Trends. For DEA inspection readiness as it relates to fraudulent prescription documentation, see the DEA Inspection Prep guide.