What serialisation can and cannot reach

Serialisation is presented, fairly, as the answer to falsified medicines. It is a good answer to one specific part of the problem. Which part is worth stating precisely, because overstating it breeds misplaced confidence, and understating it leads people to conclude it was not worth the money.

What the figures actually support

The most solid public estimate comes from the World Health Organization: at least 1 in 10 medicines in low- and middle-income countries is substandard or falsified, with around US$ 30.5 billion a year spent on such products.

Two cautions, because this field is full of figures repeated long after their evidence ran out.

First, substandard and falsified are counted together in that estimate, and they are different failures. A substandard product comes from a legitimate manufacturer with a quality problem. A falsified one deliberately misrepresents its identity or its source. Serialisation addresses the second and does nothing about the first.

Second, claims such as “half of all medicines sold online are counterfeit” need handling with care. They circulate in industry material with weak sourcing. Unauthorised online sale is clearly a major route; the precise share usually attached to it is not supported.

What the unique identifier protects

Serialisation protects the legal supply chain: manufacturer, wholesaler, pharmacy, patient. Inside that chain it works. An identifier that does not exist, or that has already been dispensed, is caught at the pharmacy counter. Slipping falsified product into the legal chain, historically through the more complex routes such as parallel trade and re-import, becomes much harder.

That is a real gain, and a bounded one.

What it does not reach

Anything sold outside the legal chain is out of reach. An unauthorised online seller does not scan, verify or decommission anything. The product never enters a system that checks identifiers, so serialisation puts no obstacle in its way.

A copied code is only caught late. The identifier is printed in clear text, and copying it onto a falsified pack is easy. What defeats the copy is that the genuine identifier will eventually be dispensed somewhere and raise a duplicate-status alert. Detection therefore happens after the fact, and only if someone investigates the alert properly.

Quality failures pass straight through. A pack holding the wrong dose from a legitimate line carries a perfectly valid identifier.

And the system stops at dispensing. Once the identifier is decommissioned, what happens to the medicine afterwards is outside its scope.

Why this framing matters operationally

It changes what you staff and what you measure.

If serialisation were a complete answer, the alert queue would be a fraud detection desk. In practice most alerts trace back to data problems (a scan error, a pack decommissioned twice, an upload that never completed), and treating each one as suspected falsification uses up the attention the genuine cases need. The quality of alert triage is the control that matters, and it is a data integrity discipline more than a security one.

It also sets the right expectations with the rest of the business. Serialisation is a control on the legal chain, and a substantial one. It was never designed to stop medicines sold outside that chain.

Being clear about that boundary is what lets you defend the investment. Claim more than a control can deliver and it will be judged on the gap.

References

• WHO, Substandard and falsified medical products, fact sheet, 3 December 2024.