Online Pharmacy Fraud: Stolen Cards Buying GLP-1s and Rx Drugs

On this page 8 sections

1. Why Fraudsters Target Telehealth and Online Pharmacies
2. Common Patterns: Synthetic Patients, Reshippers and Account Takeover
3. ID Verification During Intake vs. at Payment
4. Matching Patient Name, Cardholder and Shipping Address
5. Velocity Rules to Curb High-Resale Medication Fraud
6. 3D Secure and Liability Shift on Medication Orders
7. Handling Confirmed Fraud: Refunds, Reporting and Records
8. Next Steps for Online Pharmacy Fraud Prevention

Key takeaways

• Cash-pay injectables and other medications with high resale value attract fake patients, reshippers and stolen cards.
• Verify identity at intake, then confirm that the payment and shipping details fit that verified patient.
• Velocity rules across card, device, address and patient catch the resale buyer that one-off checks miss.
• Handle confirmed fraud quickly: stop shipment, settle the refund-or-chargeback question, and keep a clean evidence file.

Telehealth clinics and online pharmacies sell what fraud rings look for: cash-pay medications with real resale value, shipped to whatever address the buyer types in. This guide covers online pharmacy fraud prevention for merchants. It explains why fraudsters target the sector, the fake-patient and reshipper patterns behind most bad orders, and the identity, payment and velocity checks that stop them. It also shows how to apply those checks without turning away the legitimate patients who make up most of your volume.

Why Fraudsters Target Telehealth and Online Pharmacies

Most e-commerce fraud is about getting goods that are easy to resell. Prescription medications fit that description, and in-demand injectables such as GLP-1 pens are especially attractive. Several features of telehealth make it worse:

• Cash-pay orders. Many patients pay out of pocket rather than through insurance, so the card is the only payment check in the transaction.
• Remote everything. Intake, provider review, payment and delivery all happen without anyone meeting the patient in person.
• Ship-to-door fulfillment. Medications go to the address the buyer supplies, often with expedited or temperature-controlled shipping.
• Recurring programs. Subscription and refill models mean one fraudulent signup can produce several shipments before anyone notices.

There is also an underwriting cost. Fraud chargebacks on medication orders count toward your dispute ratios. Telehealth already sits in the high-risk category for most acquirers, so a fraud wave can put your account at risk quickly. Our guide to telehealth merchant accounts and how to get approved explains why processors watch this sector closely.

Common Patterns: Synthetic Patients, Reshippers and Account Takeover

The same few patterns account for most bad pharmacy orders. Knowing what each looks like helps you aim your controls.

Synthetic Patients and Telehealth Identity Fraud

A synthetic patient is an invented identity, sometimes built partly from real data, that is created to pass intake. Common signs:

• Intake answers that match other recent submissions word for word, or that hit every eligibility box with no variation
• Profile photos or ID images that look edited, low-resolution or reused
• Several "patients" created from the same device, browser fingerprint or IP range
• A stated home state that doesn't match where the person appears to be connecting from

That last signal matters more in telehealth than in ordinary retail. Prescribing generally depends on where the patient is located, so a location mismatch is a clinical-compliance problem as well as a fraud signal.

The Stolen Credit Card Prescription Order

A stolen credit card prescription order usually goes like this. The fraudster pays a consult fee with a stolen card, completes intake (often as a synthetic patient), and then pays for the medication with the same card or a different one. Some test cards on your low-dollar consult fee first. If your checkout sees bursts of small declines, read our guide to stopping card testing attacks at checkout.

Reshipper Fraud in Pharmacy Orders

Reshipper fraud uses a middle address. The order ships to a package-forwarding service, a freight consolidator or a "drop" person who repackages it and sends it on, sometimes overseas. Watch for:

• Shipping addresses that resolve to known forwarding or mail-receiving businesses
• Suite or unit numbers that look like customer account IDs
• Many unrelated patients shipping to the same address
• Requests to change the shipping address after the prescription is approved

Account Takeover on Patient Portals

Here a real patient's account is compromised, often through reused passwords. The attacker updates the shipping address or payment method and then requests a refill. Because the patient history is genuine, these orders get past intake checks easily. Protect accounts with step-up verification on address changes, alerts to the patient's existing email and phone, and a short hold on the first shipment to any new address.

ID Verification During Intake vs. at Payment

Identity checks can happen at two points. Each catches different problems.

The strongest setups use both, plus a link between them: the verified patient identity from intake should be consistent with the payment and shipping details. A practical sequence:

1. Verify identity at intake with document and selfie checks, or with data-based identity verification, scaled to the medication's risk.
2. Collect device and location signals during intake and store them with the record.
3. Authenticate the payment with AVS, CVV and, for higher-risk orders, 3D Secure.
4. Compare the three: patient identity, cardholder data and shipping address.

One caution: fraud screening tools may receive patient data. Don't send diagnosis or treatment details to vendors that don't need them, and confirm with counsel whether a vendor relationship needs HIPAA safeguards. Our article on whether your payment processor is HIPAA compliant covers how payment data and PHI should stay separate.

Matching Patient Name, Cardholder and Shipping Address

In a typical fraud order, these three don't line up. But mismatches are also common in legitimate orders, so treat them as risk signals, not automatic declines.

Legitimate reasons for mismatches:

• A spouse, parent or adult child pays for the patient's medication
• The patient recently moved and the card's billing address is out of date
• The patient ships to a workplace to avoid leaving a package unattended
• A family member uses an HSA or FSA card in someone else's name

Combinations that deserve review:

• Cardholder, patient and shipping recipient are three different names with no apparent relationship
• AVS fails and the shipping address is a forwarding service
• The billing address is in one state, the patient claims another, and the IP is in a third, or outside the U.S.
• A first order on a new card ships expedited to an address never seen before

A tiered response keeps friction low for real patients:

1. All three match and AVS passes: approve.
2. One explainable mismatch: approve, or ask a quick confirmation question such as "Who is the cardholder for this order?"
3. Multiple mismatches or a forwarding address: hold for manual review or require 3D Secure.
4. Mismatches plus device or velocity flags: decline and refund any consult fee already captured, according to your policy.

Velocity Rules to Curb High-Resale Medication Fraud

One order on its own often looks fine. High-resale medication fraud shows up in patterns across orders. Velocity rules count activity over a time window and flag accounts that exceed normal behavior.

Track velocity across several dimensions at once:

*Illustrative only. Set thresholds from your own order data and patient population, and adjust them over time.

Apply tighter rules to the medications that attract resale, typically injectables and other high-value cash-pay drugs. Use lighter rules for low-value products. A household where two patients share an address is normal. Ten unrelated patients at one suite number is not.

Subscription programs add a wrinkle, because dose changes and plan switches create legitimate spikes in activity. Our guide to billing GLP-1 subscriptions through dose changes explains how to structure those changes so they don't trigger your own fraud rules.

3D Secure and Liability Shift on Medication Orders

3D Secure adds a cardholder authentication step with the card issuer, often handled invisibly through a risk check, sometimes with a one-time code or banking-app approval. On medication orders it does two things:

• It filters stolen cards. A fraudster with card numbers but no access to the cardholder's phone or banking app often can't complete authentication.
• It can shift liability. When a transaction is successfully authenticated, responsibility for certain fraud chargebacks may move from the merchant to the issuer under card network rules. The shift doesn't apply to every dispute type, such as "item not received" or service complaints, and the details vary by network and transaction type.

Practical guidance for pharmacy merchants:

• Use it selectively if friction is a concern. Trigger 3D Secure on first orders, new cards, address changes and high-resale medications. Let low-risk refills from established patients go through with less friction.
• Authenticate the first charge in recurring programs. Later merchant-initiated renewals generally rely on that original setup. Ask your processor how authentication applies to your billing model.
• Store the results. Authentication data is key evidence if a dispute comes in.

MannyPay supports 3D Secure authentication for online payments. Confirm current liability-shift rules with your processor, because network requirements change.

Handling Confirmed Fraud: Refunds, Reporting and Records

When you confirm an order was fraudulent, act quickly and in this order.

Stop the Shipment

If the order hasn't shipped, cancel it. If it is in transit, contact the carrier about an intercept or return to sender. Notify the dispensing pharmacy and prescriber so the prescription is voided. Returned dispensed medications are generally restricted from restocking, so check your state pharmacy rules and your pharmacy partner's policies before planning on resale.

Decide Between a Refund and a Chargeback

• No chargeback filed yet: Refunding the real cardholder can prevent a dispute and protect your ratios. Refund to the original card only, never to a different payment method.
• Chargeback already filed: Don't also issue a refund, or you may lose the money twice. Accept or respond to the dispute through your processor.

For disputes you do fight, our guide to winning telehealth chargebacks without exposing PHI covers what evidence to submit and what to leave out.

Report and Block

• Add the device, card fingerprint, email, phone and shipping address to your internal blocklist.
• Close or lock the patient account. For account takeovers, restore access to the real patient and reset their credentials.
• Consider a police report for organized or repeat activity. Ask counsel whether any regulatory or board reporting obligations apply to your situation.

Keep Records

Build an evidence file for every fraud case: intake timestamps, IP and device data, AVS and CVV results, 3D Secure outcome, shipping and tracking details, and every communication. Store clinical details separately under your HIPAA controls. These records help you tune your rules and show your processor that you manage risk actively.

This section is general information, not legal or regulatory advice. Pharmacy, telehealth and privacy rules vary by state and change over time. Confirm your obligations with a qualified professional.

Next Steps for Online Pharmacy Fraud Prevention

Effective online pharmacy fraud prevention is layered: verify the patient, authenticate the payment, check that patient, cardholder and address fit together, and watch velocity across orders. Put the most friction on high-resale medications and first-time activity, and keep the experience smooth for established patients.

If you're reviewing your processing setup, MannyPay offers high-risk merchant accounts and payment processing for telehealth and online pharmacy businesses, including online gateways and 3-D Secure. Request a free quote and a MannyPay specialist will respond within one business day.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.