Track-and-trace serialization across the pharmaceutical supply chain — GS1 DataMatrix codes, EPCIS scan events, and anomaly detection against WHO SSFFC falsified-medicine estimates
The foundation of modern anti-counterfeiting is deceptively simple: print a unique, unpredictable serial number on every single saleable unit before it leaves the manufacturing line. Combined with a GS1-standard 2D DataMatrix barcode encoding the product identity, batch, and expiry, this single act transforms a mass-produced commodity into a set of individually trackable objects — the prerequisite for everything that follows in track-and-trace.
A compliant 2D DataMatrix on a pharmaceutical pack encodes four GS1 Application Identifiers:
• GTIN (Global Trade Item Number) — identifies the exact product, strength, and pack size • Batch/Lot number — links the unit to its manufacturing record and QC release • Expiry date — supports automated shelf-pull and recall logic • Serial number — a unique, randomized identifier per individual pack (not sequential, to prevent guessing)
Aggregation hierarchy: • Each pack (SGTIN) is scanned into a case using an SSCC (Serial Shipping Container Code) • Cases are scanned into a pallet, itself carrying its own SSCC • Parent-child relationships are recorded once, at packing time, so a single pallet scan can later "explode" into its full manifest of thousands of individual serials without re-scanning each one
Regulatory drivers: • EU Falsified Medicines Directive (FMD, 2011/62/EU) made unique identifiers and tamper-evident features mandatory on prescription packs from February 2019, verified against the European Medicines Verification System (EMVS) at the point of dispensing • US Drug Supply Chain Security Act (DSCSA, 2013) phased in unit-level, interoperable, electronic traceability with a final compliance deadline of November 2023 • Both frameworks converge on the same technical backbone: GS1 GTIN + serialization + event-level data exchange
A serial number alone is inert. Its value comes from the trail of events recorded every time the pack changes hands. GS1's EPCIS (Electronic Product Code Information Services) standard defines a common vocabulary — what, when, where, why — so that a scan at a distributor in one country and a scan at a pharmacy in another can be stitched into a single, interoperable custody chain.
Each EPCIS ObjectEvent records:
• What — the EPC (electronic product code) / serialized GTIN of the pack or aggregate • When — event time and record time (distinguishing when it happened vs. when it was logged) • Where — read point (the scanner) and business location (the facility) • Why — business step (commissioning, shipping, receiving, dispensing) and disposition (active, in_transit, sold)
Commissioning → shipping → receiving forms the minimal chain for one hop. A full pack's history from plant to pharmacy counter is a linear sequence of these triplets, each cryptographically or contractually attributable to the scanning party.
MediLedger blockchain pilot: • Formed to solve DSCSA's 2023 interoperability requirement without forcing every trading partner onto one shared database • Uses blockchain to verify that a given serial number was legitimately commissioned by an authorized manufacturer, without exposing full transaction data to competitors • Participants include major US wholesalers and manufacturers; validated saleable-return verification (confirming a returned pack is genuine before it re-enters saleable inventory) as an early production use case • Demonstrates that distributed ledger technology can provide trust between competitors who will not share a central database, a recurring problem in multi-party supply chains
With millions of scan events flowing in daily, human review is impossible — detection has to be automated. Three categories of rule-based and statistical anomaly detection catch the overwhelming majority of falsified or diverted product: duplicate-serial detection, unregistered-serial detection, and velocity/geography outlier detection.
Duplicate serial numbers: • The single strongest counterfeit signal — a legitimate serial can only be sold once • If the same GTIN+serial is scanned as "dispensed" twice, or scanned in two distant markets within an implausible window, at least one of those packs is fraudulent (cloned code, "grey market" diversion, or repackaged counterfeit)
Invalid / unregistered serials: • Scan resolves against the serialization database and finds no matching commissioning event at all • Common with fully counterfeit product manufactured outside any legitimate line, printing a plausible-looking but fabricated DataMatrix
Statistical anomaly flags: • Velocity checks: a pallet reported "received" in a second country before transit time from the first is physically possible • Geographic mismatch: product commissioned for one national market appearing in a different market's supply chain (parallel trade or diversion) • Volume spikes: a wholesaler suddenly moving 10x its historical volume of a given SKU
These three layers are typically combined into a single risk score per scan event, with high-confidence hits (duplicate + unregistered) triggering an automatic quarantine hold and lower-confidence anomalies routed to a human investigator queue.
Serialization only protects patients if the last mile — the pharmacist or the patient themselves — can actually check a pack before it is used. Mobile verification systems pioneered in West and East Africa put that check in the hands of anyone with a basic mobile phone, closing the loop between manufacturer data and the point of consumption.
Both mPedigree and Sproxil were designed around the reality that most at-risk patients in low- and middle-income countries carry basic feature phones, not smartphones, and may have limited data connectivity:
1. A unique code is printed under a scratch-off panel on the pack (a low-tech complement to the machine-readable DataMatrix) 2. The buyer scratches the panel and texts the code to a free short code via SMS 3. The verification server checks the code against the manufacturer's registered serial database 4. An SMS reply confirms "Genuine" or flags the product as unregistered/suspect, typically within seconds
Why this matters for detection coverage: • Automated EPCIS anomaly detection (Stage 3) catches fraud upstream, between manufacturer and pharmacy — but it cannot see product that bypasses the formal distribution chain entirely, e.g. sold through informal market stalls • Consumer-facing scratch/SMS verification extends the detection surface all the way to the end user, the only party with certain knowledge of whether the pack in their hand is genuine • Aggregated verification query data itself becomes a valuable anomaly signal: a spike in "not found" responses from a specific pharmacy or region flags a local counterfeit hotspot even before formal chain-of-custody data reveals it
Detecting a single counterfeit pack is only the beginning. The operationally critical question is where in the supply chain the falsified product entered — because that is the point that needs to be shut down, investigated, or reported to regulators before more counterfeit stock reaches patients.
When a scan resolves as suspect, the trace-back algorithm queries the EPCIS repository for every prior event referencing that serial (or its parent aggregate) and reconstructs the path in reverse chronological order:
Pharmacy dispensing event → wholesaler shipping event → distributor receiving event → distributor shipping event → manufacturer commissioning event (if one exists at all)
Two outcomes determine the response:
1. A legitimate commissioning event exists but the chain shows an unexplained gap or an unauthorized intermediate node — this points to diversion or re-entry of stolen/expired genuine product, or a counterfeit substitution somewhere in a specific custody segment. Investigators focus on the facility responsible for that segment.
2. No commissioning event exists anywhere in the system — the pack is wholly counterfeit, manufactured outside the legitimate supply chain and introduced at whatever node first scanned it "in." That node — often an informal wholesaler or an unauthorized import channel — becomes the priority target for regulatory action and law enforcement referral.
The trace-back output is typically visualized as a path highlighted across the full custody graph, letting an investigator see at a glance which single node is common to multiple counterfeit incidents — the classic signature of a compromised or complicit facility.
Point-of-entry trace-back converts anti-counterfeiting from a purely reactive, pack-by-pack exercise into a network-level intelligence tool: once a facility is identified as the common origin across multiple flagged packs, regulators can act on the node itself rather than chasing individual counterfeit units indefinitely.
Individual detections matter, but regulators, manufacturers, and public health agencies need an aggregate picture: what fraction of the whole system is verified authentic, and how does the detection rate compare against the underlying prevalence of substandard and falsified product the WHO has documented globally.
A supply-chain integrity dashboard typically rolls up three numbers:
• Verified-authentic transaction rate — the share of all scan-and-verify events that resolved as genuine, unmodified, correctly-chained product • Detection rate — flagged incidents as a share of total volume, benchmarked against the WHO SSFFC estimate that roughly one in ten medical products circulating in low- and middle-income countries is substandard or falsified • Time-to-detection — median elapsed time between a counterfeit pack entering the chain and its first flag, a metric serialization programs aim to compress from months (pre-serialization, driven by adverse-event reports) to minutes (post-serialization, driven by real-time EPCIS anomaly rules)
Why the gap between "detection rate" and "true prevalence" matters: • A track-and-trace system only sees what passes through registered scan points; product that never enters the formal distribution chain (informal markets, unlicensed online pharmacies) is invisible to it • Consumer-facing verification (Stage 4) partially closes this gap by extending detection to the point of consumption, but coverage still depends on patient awareness and willingness to check • Programs therefore report integrity metrics alongside independent post-market surveillance sampling (WHO Member State mechanism for SSFFC reporting) to estimate the residual undetected fraction
Mature serialized markets (EU under FMD, US under DSCSA) now report verified-authentic rates above 99.5% for product moving through the formal chain — underscoring that the remaining risk is concentrated in informal and online channels the formal serialization infrastructure does not yet reach.