How counterfeiters are breaching India’s QR code system
If the QR code system is not all that it was promised to be, what are the next steps to safeguard our medicines?
There is growing concern that a sizable proportion of medicines in India could be unsafe for patients. For example, on April 19, 2025, CDSCO published three lists of Not of Standard Quality (NSQ) drug alerts for March 2025, spanning 131 product batches. The most common reason cited is failing the dissolution test as per IP 2022.
In the recent past, pharma associations as well as many individual pharma companies have clarified the differences between various terms: spurious, NSQ and counterfeits, seeking to distance themselves from products emanating from the ‘grey market’. More recently, news has filtered out that four batches of Sun Pharma’s Levipil 500, an antiepileptic medication, have fake QR codes.
Writing for Express Pharma in two successive blog posts, Dr Avi Chaudhuri, a global expert on anticounterfeiting, gives details of how Sun Pharma seems to be the victim of digital leakage of QR codes, either from the code generating source (the vendor supplying the codes) or the code application site (Sun Pharma’s plant in Assam).
And, this is one of the early companies to comply with the Ministry of Health and Family Welfare’s QR code mandate for the top 300 drugs, “in ways that security specialists view as a best-practices approach”. As he argues, the QR code has turned out to be a “gift to the counterfeiter.” (Ref: Sun Pharma must immediately declare a voluntary recall of Levipil 500)
As Dr Chaudhuri narrates, counterfeiters succeeded in placing a unique active code on every fake package, and that each counterfeit variant will therefore be successfully authenticated in the hands of a consumer.
His findings were subsequently supported by further investigation by Dr Hemant G Koshia, Commissioner, Food & Drugs Control Administration (FDCA), Gujarat. The FDCA investigation concluded that “the incident represents a first-of-its-kind operation involving interstate trade of counterfeit drugs with active QR codes encompassing at least six states as of now (Delhi-NCR, Gujarat, Madhya Pradesh, Maharashtra, Uttar Pradesh and West Bengal)” and involved 8-10 distributors in Gujarat alone.
We have approached Sun Pharma for a response to this news, and will feature an update when we do get a response. The company, like a few of its peers, has acted proactively in the recent past, issuing an advisory to its distributors on the escalating threat of counterfeit medicines. The advisory dated March 18, 2025 reportedly urged its CFAs and distributors to purchase only from authorised sources to prevent counterfeit and substandard drugs from entering the supply chain.
If the QR code system is not all that it was promised to be, what are the next steps to safeguard our medicines? As it primarily seems to be a case of a compromise of the serial number bank, what can companies do to prevent such digital theft? How can they respond faster, with recalls and increased consumer awareness campaigns, when counterfeiters manage to outsmart the system?
Dr Chaudhuri has suggested three steps in his second blog post: inactivating all serial numbers associated with the four batches of Levipil 500 known to have been compromised so far — (GTF0885A, GTF1456A, GTF1540A and GTF3432A), ordering a voluntary recall of all Levipil 500 products belonging to these four identified batches thus far and thirdly, understanding how this happened and disclosing it so that the whole industry can take preventive steps.
It’s clear that we need changes at the policy level too. India’s pharma sector has invested precious resources and time to deploy track and trace (TnT) infrastructure in order to comply with the QR code mandate. Such incidents beg the question: were they the wrong choice of TnT systems, given the complexity of India’s pharma supply chain? Could these failures be due to faulty implementation? And more importantly, where do we go from here?
Commenting on Dr Chaudhari’s investigations and conclusions, Bejon Misra, founder of Patient Safety and Access Initiative of India Foundation and a consumer policy expert, says,“Both the blogs talk about what we already know and had shared with the Government regarding the risks connected with QR Code. Unfortunately, the Government never takes us seriously. We had at length proposed the technology that will enable a robust tracing and tracking system to protect the consumers from spurious and NSQ medicines. World over the accepted technology is being implemented and it is high time India harmonises with the world. We must go for serialisation and data security in a robust manner. Jan Aushadhi has constituted a Committee to look at Blockchain Technology as an option.”
While we wait for more clarity and action from the various stakeholders, it is clear that counterfeiters will always outsmart technology. It is time policymakers and pharma companies enlist India’s patients and caregivers in this war against counterfeiters. After all, they stand to lose the most.
VIVEKA ROYCHOWDHURY, Editor