The Pharmacy Fraud That Keeps Me Up at Night
When most pharmacy owners hear the words “pharmacy fraud,” they picture something obvious — fake prescriptions, sketchy patients, forged IDs. The stuff you can spot from across the counter.
But the pharmacy fraud that worries me the most?
It doesn’t happen in the pharmacy. It happens quietly, digitally, and without triggering a single red flag.
Recently, I worked with an independent pharmacy owner who reached out because their PBM reimbursement checks had suddenly stopped showing up. Claims were still adjudicating. Reports looked normal. Nothing appeared “wrong.”
Until they dug deeper.
A hacker had gotten into their PBM portal, changed the pharmacy’s mailing address, and redirected reimbursement checks somewhere else. Tens of thousands of dollars potentially gone… and the owner had no idea until cash flow started to tighten.
No verification of changes. No alerts. Just missing money.
That’s when I knew we needed to start talking more openly about pharmacy fraud prevention, because this kind of fraud can take down a good pharmacy fast.
The New Face of Pharmacy Fraud (And Why It’s So Dangerous)
Here’s the truth most owners don’t realize:
The most dangerous pharmacy fraud today doesn’t look suspicious.
It looks like:
- Clean logins
- Approved claims
- Normal reports
- Empty bank accounts
Independent pharmacies are especially vulnerable because we sit in the middle of so many systems: PBMs, wholesalers, PSAOs, portals, vendors, billing platforms, etc. Every one of them is a potential entry point.
And fraud doesn’t care how good of a pharmacist you are.
The 5 Types of Fraud I’m Seeing Hit Pharmacies Right Now
1. PBM Reimbursement Fraud (The Silent One)
This is the exact scenario that the owner above experienced — and it’s becoming more common.
PBM portals allow users to update:
- Mailing addresses
- ACH information
- Contact details
If someone gains access, they don’t need to touch your claims. They simply redirect where the money goes.
What makes this dangerous is that:
- Claims still show as “paid”
- Reports look fine
- You don’t notice until your cash flow takes a hit
What I recommend doing immediately:
- Limit PBM portal access to one or two trusted people
- Turn on multi-factor authentication everywhere it’s available
- Review payment addresses and ACH details quarterly
- Put PBM payment verification on your controlling calendar
If you’re not actively checking, you’re trusting that nobody else is.
2. ACH and Vendor Payment Redirection Scams
I see this one spike around the holidays when everyone is busy and distracted.
You get an email that looks legitimate:
“Hi, we’ve updated our payment information. Please update your ACH details.”
One change. Money gone.
How I protect against this:
- Never update payment information from an email alone
- Require verbal verification with a known contact
- Document vendor payment changes
- Require dual approval for any banking changes
Urgency + money requests should always make you slow down, not speed up.
3. Internal or Employee Pharmacy Fraud (Uncomfortable but Real)
I trust pharmacy teams, and you probably do too. But trust without controls puts everyone at risk.
The most common internal issues I see:
- Refund abuse
- Inventory shrink
- Gift card misuse
- Skimming small amounts over time
What I recommend:
- Separate duties (ordering, receiving, posting)
- Review POS exception reports monthly
- Review RTS activity logs monthly
- Rotate responsibilities periodically
Controls don’t mean you don’t trust your team. They protect good employees and the business.
4. Cybersecurity Breaches and Credential Theft
Most pharmacies are running on:
- Shared passwords
- Old systems
- Remote access tools
- Limited IT oversight
That’s a perfect storm.
My non-negotiables:
- Unique logins for all financial and PBM systems
- Password manager use
- Quarterly password changes for sensitive portals
- Regular system updates
- Staff training on phishing and suspicious emails
Pharmacy cybersecurity is no longer an IT issue. It’s a financial survival issue.
5. Fake Audits, Legal Threats, and Compliance Scams
I’ve seen scammers pose as:
- PBMs
- CMS
- State boards
- DEA contractors
They rely on fear and urgency to get information.
My rule:
- No information without written verification
- Staff must escalate any “official” request
- One internal compliance point person
- When in doubt, pause
Real regulators don’t rush you or threaten you over email.
Why Independent Pharmacies Are Hit Harder
Chains have fraud teams, alerts, and cash reserves.
Independent pharmacies have:
- One owner
- One office manager
- And about a hundred other things are pulling your attention
That doesn’t make you weak — it means you need systems.
Fraud prevention has to be intentional.
My Pharmacy Fraud Prevention Checklist
If you do nothing else this month, do these five things:
- Audit all PBM portals for payment information
- Lock down access and enable MFA (multi-factor authentication)
- Create a “no payment changes by email” rule
- Review reimbursement deposits weekly
- Add fraud checks to your controlling calendar
Fraud prevention isn’t a one-time task. It’s a habit.
Fraud Isn’t Personal, But the Damage Is
That pharmacy owner didn’t do anything “wrong.”
They were busy. They trusted the system. They were focused on patients.
And that’s exactly who fraud targets.
I don’t want you operating in fear. But I do want you operating with your eyes open. Because in today’s environment, protecting your revenue is just as important as generating it.
At DiversifyRx, my goal is to help independent pharmacies survive the stuff no one warns you about, so you can keep serving your community long-term. Check out Pharmacy Badass University and consider joining if you’re serious about growing your pharmacy the smart way.
