Counterfeit diagnostic tests: an IVD authentication and procurement guide

What are counterfeit diagnostic tests?

Counterfeit diagnostic tests are IVD products manufactured or distributed with deliberate misrepresentation of their identity, composition, or source. In practice they take several forms: fake kits printed to imitate a known brand, genuine packaging refilled with unapproved strips or cassettes, expired lots relabeled with new dates, and unauthorized copies sold through online marketplaces. The WHO calls this category falsified medical products, distinguishing it from substandard products that fail quality standards through poor manufacturing rather than intent.

The scope covers the full kit, not only the device inside. A rapid test reaches users as a foil pouch, folding carton, instructions-for-use leaflet, and increasingly a digital verification element. Counterfeiters target the printed components first because those are what buyers and users inspect, so the strategy must protect the packaging system as a whole.

In vitro diagnostics span professional-use tests bought by ministries of health and donor programs, over-the-counter self-tests sold through pharmacies and e-commerce, and chronic-care consumables such as glucose test strips. Buyers in each segment face different counterfeit patterns but share one question: how can my team confirm that this kit, in this warehouse, is the product we paid for?

Why falsified tests are a patient-safety problem, not just a brand problem

The main procurement risk is silent clinical failure. The FDA’s page on counterfeit at-home COVID-19 tests explains the mechanism plainly: counterfeit tests are not authorized by the agency, their performance has not been verified, and false negatives can delay diagnosis and spread infection while false positives delay correct treatment for the real illness. For a screening program, a falsified batch does not merely waste money; it corrupts surveillance data and can trigger the wrong response.

Documented cases show the pattern across test types. In March 2020, WHO Medical Product Alert 2/2020 reported at least 8,240 units of a falsified HIV rapid diagnostic test, claimed to be Trinity Biotech’s Uni-Gold HIV, distributed at end-user level in Guyana and later found in Kenya. The manufacturer confirmed it did not make the product and that the genuine lots shown on the fake boxes had expired in 2019. WHO flagged delayed HIV diagnosis as the health consequence.

Chronic-care consumables carry the same risk in individual form. The FDA has warned that pre-owned or unauthorized test strips, including glucose and INR strips resold through online marketplaces, may be expired, stored improperly, or contaminated, and that inaccurate results can lead patients to take too much or too little insulin or warfarin, with potentially serious injury or death. The wider problem is large: WHO estimates about 1 in 10 medical products in low- and middle-income countries is substandard or falsified, costing countries an estimated US$ 30.5 billion a year.

For IVD manufacturers, falsified kits also corrupt the data layer of the business: lot numbers, expiry dates, and serial numbers feed complaint triage and field surveillance, and fakes circulating under the brand’s name make both unreliable.

Where fake test kits enter the supply chain

Falsified diagnostics rarely appear first at the clinic; they enter where custody, documentation, and physical checks are weakest. The table maps typical entry points and the controls that address them.

Donor-funded procurement adds a governance layer: under the Global Fund’s quality assurance policy, IVDs bought with grant money must qualify through pathways such as WHO prequalification, stringent regulatory authorization, or time-limited Expert Review Panel for Diagnostics review, with manufacturing sites expected to comply with ISO 13485. Those rules decide which products may be bought; authentication decides whether the carton that arrives is one of them.

Authentication options for test kits, compared

No single feature defeats every counterfeit attempt. The practical question is what each option verifies, who can check it, and what a counterfeiter must defeat.

A robust program combines layers: a visible serial or UDI carrier for traceability, a phone-readable code for public engagement, and a covert layer that only authorized staff can check. For the broader trade-off, Mina’s comparison of invisible packaging codes and label strategies applies the same logic to packaged goods.

How layered marking works on IVD kit components

Mina applies ultra-invisible anti-counterfeiting information to the printed components a test kit already carries: the label, foil pouch print, folding carton, instructions-for-use leaflet, and certificate insert. The hidden information integrates into existing artwork without changing the visible design, and it stays invisible under normal light, ultraviolet light, and infrared light, so conventional equipment does not reveal it.

Verification happens through dedicated detection devices supplied only to Mina’s partner clients, each with a unique identification number. Audio verification returns sound and vibration on a genuine component and no reaction on a fake; image verification displays the covert information on genuine components and shows no content on fakes. Because the check takes seconds and needs no laboratory, it fits incoming inspection at central medical stores and audit visits at distribution points.

The covert layer backs up the visible code rather than replacing it. Overt and covert data are interrelated: if a visible serial or barcode is damaged, the covert information can still be read, so a tampered kit remains traceable to its recorded lot and market. The falsified HIV test case matters here because counterfeiters manipulated exactly the visible data, lots and expiry dates, that routine checks rely on.

For consumer-facing self-tests, Mina’s AI cloud code adds a phone-readable layer: a dot-matrix code whose points carry random visual-AI features, readable with an ordinary smartphone camera and stable at consumer-scan volumes. Verification pages can record first query time and query counts for each code, the signal that exposes a code copied onto many fakes. Program owners who also need channel control can extend the same one-item-one-code data into distribution audits, the approach described in Mina’s guide to stopping product diversion in consumer supply chains.

Two boundaries keep the design honest. First, marking protects identity and traceability; it does not measure analytical performance, and a genuine kit still has to meet its quality standards. Second, integrating marker material into molded plastic cassettes is a separate engineering question, depending on the polymer, process, and the device’s regulatory file, so it belongs in a feasibility and acceptance-testing track rather than assumed. Manufacturers can pair this with Mina’s framework for medical device anti-counterfeiting and regulatory compliance.

Verification and acceptance testing workflow

Use this workflow both to qualify a marking project before rollout and to operate field verification afterwards.

1. Define the threat model. Decide which fraud patterns matter most: copied kits, relabeled expired lots, diversion across programs, refilled pouches, or marketplace fakes. The marking design and inspection points follow from this list.
2. Map the components to be protected. Choose where covert information sits, typically the pouch print, carton, leaflet, and certificate, and which audience checks each layer: brand auditors, program inspectors, or consumers.
3. Build test panels. Assemble genuine samples from current production, copied artwork printed from scans, relabeled samples with altered lots and expiry dates, and expired genuine stock. The system is credible only if inspectors distinguish every panel member.
4. Run acceptance testing. Verify that hidden information survives the real supply chain: pouch film and lamination, carton converting, transport vibration, and storage at the temperature and humidity your markets experience. Confirm readout reliability with each detection device and recheck after simulated aging.
5. Stand up device governance. Register every detection device and holder, define who may verify and where results are logged, and set an escalation path from a failed field check to quarantine, manufacturer notification, and, where appropriate, a report through national pharmacovigilance or WHO reporting channels.
6. Audit and adapt. Review verification logs, first-query anomalies, and field incidents quarterly. Counterfeiters adapt, and the inspection plan should adapt with them.

Document the workflow in the procurement file. When a donor audit or regulator asks how the program assures kit authenticity, the answer should be a controlled process with evidence.

Governance: regulation, procurement, and data discipline

Authentication sits inside a regulated environment, and buyers should align three governance layers. First, market access rules: in the EU, the IVDR requires IVDs to carry a unique device identifier, combining a device identifier with production identifiers such as lot and expiry, in human-readable and machine-readable form, with data registered in EUDAMED. A UDI carrier is a compliance obligation and a serialization backbone, but a printed code alone does not prove authenticity, which is why a covert layer adds value on top of it.

Second, procurement rules: donor-funded buyers operate under quality assurance policies defining which products may be purchased, from WHO prequalification to time-limited Expert Review Panel approval, with price and quality reporting for grant-funded purchases. Malaria diagnostics show the volumes at stake: 348 million tests were sold by manufacturers in 2019, and Global Fund-financed procurement accounted for roughly two-thirds of market volume. At that scale, even a small falsification rate reaches millions of patients, so incoming authentication belongs beside the QA paperwork.

Third, data discipline: every serial, verification event, and first-query record is operational data. Define ownership, retention, sharing with regulators or donors, and how personal data from consumer scans is handled under privacy law. WHO’s Global Surveillance and Monitoring System, running since 2013, shows why: alerts are only as good as the reports submitted, and verification logs make a report credible.

Limitations and risks buyers should state openly

Covert authentication has boundaries, and a procurement decision is stronger when they are explicit. Authentication confirms identity and source; it does not certify analytical performance, and it cannot distinguish a genuine but substandard batch from a genuine and compliant one. Quality assurance pathways remain the control for performance.

A covert marker has physical limits. Severe abrasion, solvents, or destruction of the printed component can leave it unreadable, and a missing signal after damage should be treated as inconclusive and escalated, not automatically as proof of counterfeiting. Verification also depends on device availability: detection devices are supplied to partner clients only, so programs must plan coverage, training, and custody before relying on field checks in remote regions.

Consumer-facing codes carry their own failure modes. A copied QR or cloud code resolves on a fake until query analytics flag duplicate first scans, so programs should monitor scan data rather than treat a working link as proof. No marking system substitutes for contract enforcement: unauthorized overproduction by trusted suppliers is a licensing-control problem that quota governance and ordering controls address more directly.

Finally, regulatory ownership stays with the manufacturer. Any change that touches a device, its materials, or its labeling belongs in the regulatory file and should be reviewed with your regulatory affairs team before implementation.

FAQ: counterfeit diagnostic tests and kit authentication