Qualification and re-qualification of suppliers and customers are fundamental pillars of good distribution practice, and one of the highest risk areas of Good Distribution Practice (GDP). The Human Medicines Regulations 2012 require licence holders and responsible persons to implement robust procedures for establishing the authority and legitimacy of a customer and supplier. Tony Orme, Expert GDP Inspector, has previously discussed the importance of robust qualifications of suppliers and customers. MHRA is committed to supporting stakeholders and we continue to provide guidance.
MHRA requires organisations to have qualification and re-qualification procedures implemented within their quality management system. The processes we have seen during inspections can vary greatly in their detail and robustness, but there are certain elements that are incorporated in the majority of written procedures, including but not limited to GDP certification and WDA(H) and (V) checks on registers published by the licensing authority and other professional bodies. As of January 2021 UK licences and certificates issued by the MHRA can be accessed on our newly launched database . Licences and GDP certificates issued to companies located in Northern Ireland are also published on EUDRAGMDP . Checks on company websites and individuals should also be implemented, and for good reason.
Online resources provide a certain degree of confidence for conducting independent checks on licence details, such as company name, company number, site name, site address, authorised licensable activities, authorised categories of products to be handled on site and contact information. As inspectors we often see stakeholders relying on this information available in the public domain to establish the legitimacy of a business partner. Using online resources and publicly available databases is established as a standard requirement when qualifying new customers and suppliers, but what are the risks of using information that is easily available to everyone?
In a previous post Peter Brown, Lead Senior GDP Inspector, discussed how to protect yourself against false impersonation, phishing and scammers, and what additional measures you should consider as part of your due diligence checks. As part of your bona fide assessments, we expect you to adopt practices that incorporate independent checks as part of your procedures. When verifying your business partners, it is crucial that you consider your sources of information and who else may potentially have the same access. Publicly available information certainly provides a high degree of convenience and confidence, but if you have free access to it, it is worth considering who else does.
You should also be mindful when publishing your company information online and making it accessible to everyone. We have seen evidence of companies uploading authorisations issued by regulatory bodies, including MHRA and the Home Office. While it may be convenient to provide easy access to your licences, this practice increases the risk of misuse and we strongly discourage it.
As part of our regulatory work, MHRA is committed to investigating signals for potential fraudulent use of information and attempts to impersonate pharmaceutical companies. In the past few months, we have received reports of several attempts of false representation, which have become even more elaborate and, unfortunately, more convincing.
On 19 June 2020 we received a signal for a website with the domain name www.smartwayphama.co.uk, which closely resembled the domain name of Smartway Pharma Limited, a genuine wholesaler. In addition, emails purporting to be from this company contained screenshots of signatures of actual company employees, adding a further layer of legitimacy to the fraud. The fraudsters had attempted to procure medicinal products using their illegitimate façade. What gave the fraud away was omitting the ‘r’ from the correct domain name www.smartwaypharma.co.uk. Another tell-tale sign was that the website had only been registered a month before, thus raising further suspicions. Subsequently, the website was taken down on 22 June 2020. Smartway Pharma Ltd took action to remove the website and notified us in tandem when they became aware.
In late June we were also made aware of another 2 attempts to impersonate licensed UK wholesalers online, not only by means of fraudulent websites, but also using fake accounts registered on one of the most widely recognised professional social networks. On both occasions the fraudsters had created LinkedIn accounts posing as company employees, in addition to choosing superficially convincing domain names for their illegal activities.
The Agency received a referral for an individual who attempted to order large amounts of expensive antiviral medicine posing as an employee of Danel Trading Limited. They set up the domain www.daneltrading.co.uk, instead of the company’s actual domain www.danel.co.uk.
Similarly to the previous example, the website had been registered only a few months prior to the incident, despite the company having held a wholesale dealers authorisation for a number of years. In addition to the fraudulent website, the individual was using a bogus email address registered with a freely available email service - unlike actual company employees whose email addresses contained the genuine domain. This only came to light when a genuine customer responded to Danel Trading Ltd, who then notified the MHRA.
Another licensed wholesaler in the UK, Brown & Burk UK Limited, was targeted by fraudsters attempting to impersonate the company. The individuals had set up the fraudulent domain www.brownandburk.co.uk - instead of the company’s correct domain address www.bbukltd.com - and a fake LinkedIn account in an attempt to obtain medicines. On this occasion, it was a potential victim who recognised the fraudulent activity and raised a signal.
At the time of writing this post, all fake websites cited above have been taken down, but your vigilance and diligence when conducting bona fide checks of customers and suppliers remains integral to protecting the legal supply chain of medicines and the first line of defence in preventing falsified medicines from entering the supply chain, or medicines being diverted into the black market. As licence holders, we would expect that you maintain robust procedures and effective staff training in order to play your part.
Any suspicions of fraudulent activity or attempts to impersonate a licence holder should be reported to the competent authority and your local police. Case Referrals, within our Enforcement team, is the responsible team at the MHRA and they will be able to provide support if you need to raise a report. If you suspect something, they can be reached using the contact details below.
Enquiries about potential illegal dealings with medicines
Telephone (weekdays 09:00-17:00): 020 3080 6330
Telephone (out-of-hours emergency) for Case Referral Centre/Fakemeds Hotline: 07795 825 727
Email: casereferrals@mhra.gov.uk
As a final note, if you have any suspicions, please contact the Inspectorate at the earliest opportunity. The methods of phishing and impersonation techniques used are simple, but remain a threat to the supply chain.
Don’t miss the next post, sign up to be notified by email when a new post comes out
1 comment
Comment by Madeleine Ault posted on
Really useful blog Peter and Emanuela. A good time to publish when people can drop their guard during the holiday season