Criminals are using digital prescription sites to order mountains of oxycodone and other drugs for sale on the dark web.

In a shocking revelation, 404 Media has uncovered a far-reaching scheme where criminals are infiltrating the digital prescription systems used by doctors to order controlled substances like oxycodone, adderall, and fentanyl. By stealing and then impersonating doctors, drug dealers are infiltrating online prescription portals and ordering scores of drugs for eager buyers.

Most of the revelations were discovered on Telegram groups that openly promote these new drug-ordering loopholes.

It’s Identity Theft Of Doctors To Order Drugs Online

According to the report, hackers use sophisticated methods to access doctors’ and pharmacists’ personal and professional information by phishing their DEA-assigned numbers and the National Provider Identifier (NPI).

Once they have that information, they can create or hack into drug-ordering accounts in the names of those real doctors on popular Erx sites like CVS, Tebra, MastersRx, EzriRx, and McKesson.

Beyond The Prescription Tab, Into The Digital Darkside

The wave of identity theft of doctors is driven by digitization of filling pharmacy orders. Years ago, drug addicts and dealers would steal the prescription tabs of doctors and have runners go and pick up the drugs.

With digitization, hackers now have the ability to create enormous scale of their drug empires by stealing doctors identities and using the Escript process to get those drugs.

How To Create A Drug Empire With Stolen Doctors Identities

404 Media’s Joseph Cox spent months investigating the issue and talking to actual fraudsters about how they perpetrate the scheme.

Working with one fraudster who goes by the handle “Escripted”, he laid out the scam.

According to Escripted, most hackers do not perform the phishing themselves but instead purchase the stolen data from individuals specialized in that area. The phishing is carried out via phone or email.

From there, the hackers use data brokers like TLO lookups to get the doctor’s Social Security Number. With that SSN, they can create forged documents that help them round out the stolen identity. Some criminals employ alternative methods rather than data brokers, such as bribing hospital insiders for temporary access to their systems.

After obtaining the necessary information, fraudsters target “third-party doctor portals” and infiltrate the platform either by taking over accounts or creating accounts in the doctors’ names.

After that, it is as simple as filling out prescriptions in real people’s names (often real patients) and having them sent to local pharmacies. At that point, runners go in and pick up the drugs from the pharmacy.

It’s as simple as that.

Doctor Identity Theft Is Enormously Profitable

The drug business for these criminals is easy pickings and highly profitable. According to 404 Media, fraudsters take advantage of the cheap prices since the drugs are subsidized by insurance.

“Usually, when you’re dealing with eScripts [electronic prescriptions], the prices are copay, so selling them on the street is highly profitable,” the anonymous fraudster said.

LookUp Bots Can Locate Doctors’ Details In As Little As A Few Minutes

According to 404 Media, automated bots that use credit header data are the root of some of these compromises.

Depending on the bot, these can return the target’s current and historical physical addresses, phone numbers and providers, personal email addresses, information from their driver’s license, including their unique identification number and their Social Security number. As 404 Media found in its own tests, these lookups can cost as little as $15.