Fake PPE on the Rise: Don’t Get Fooled

Around the world, local agencies and institutions have scrambled to find personal protective equipment (PPE) to protect their essential employees from Covid-19. Not just healthcare workers, but also the men and women who to work to keep our cities and counties up and running, from emergency responders to maintenance workers.

Told by President Trump to fend for themselves, states that couldn’t find local PPE sources have signed contracts directly with overseas manufacturers or distributors claiming to represent them. Given the problems of getting it themselves or competing with the federal government for the same supplies, governors of seven Eastern states even agreed to work together on purchasing medical equipment.

This isn’t just a problem in the United States. Not only is PPE hard to get everywhere, but defective and counterfeit PPE is now hitting high-profile agencies. In the United Kingdom, the Department for Health and Social Care purchased 400,000 gowns from Turkey only to return them because they didn’t meet UK standards. On May 11 Health Canada ordered a recall of millions of KN95 masks after discovering them on a list of unapproved brands maintained by the CDC’s National Institute for Occupational Safety and Health (NIOSH) and has refused to pay for masks ordered from a Montreal supplier. In California, Gov. Gavin Newsom told reporters that state officials have run into fraud while trying to buy equipment. The state is currently working with the FBI to investigate scammers selling masks.

Where there’s fear, greed follows

For many, Covid-19 is scary. So much so that once health agencies started recommending the use of masks, gloves, and disinfectant to help prevent the spread of the disease, people around the world began buying up as much of those supplies as they could pile into their shopping cart or the trunk of their car.

This hoarding was annoying but at least understandable.

As the populace in general filled their carts, “entrepreneurs” filled their garages and warehouses with PPE to sell at a profit to people frightened enough to pay 10 times what the product was worth because it was no longer available.

Far from annoying, this is profiteering at its ugliest... and most dangerous.

From stockpiling to fraud

Unfortunately, the greed hasn’t stopped with people stockpiling tons of PPE or hand sanitizer and wipes to resell at a profit. It has also spawned a growing number of manufacturers and distributors of fake or counterfeit PPE.

The first, and maybe most problematic, type of fake is PPE that looks like it comes from a legitimate vendor. The packaging is correct, the documentation is correct, everything seems legit except the masks themselves are knockoffs. And not very good ones at that. Think of a PPE version of a fake Gucci, but with the potential to cause injury to the user.

However, the most common fakes we have discovered are from companies claiming to manufacture PPE that meet various federal or international standards, backed up with fake documentation or labeling. Instead of trying to forge approved brands, these companies produce PPE under their own brand. Then to prove their legitimacy, they forge ISO 13485 certifications from nonexistent certification bodies with bogus accreditation, present letters implying FDA approval, print NIOSH logos on PPE that are not NIOSH-approved, and for the EU market, print the CE Mark on products that have not been tested. The upshot is there is no third-party verification that the PPE is safe.

That government agencies could unsuspectingly buy counterfeit PPE, as has happened around the world—but not the U.S. as far as we know—is frightening because much of that PPE is intended for use by frontline workers.

Scary. But also largely avoidable.

Standards certification terms

Certification body (aka CB, CAB, registrar)—The CB is a third-party auditor that verifies whether a company meets the requirements of a particular standard, e.g., ISO 9001, ISO 13485. If it does, the company receives a certificate of conformity to that standard.

Accreditation body (AB)—The AB oversees CBs in its country. It periodically audits the CBs to verify that they are conducting their client audits properly. Typically, each country has one accreditation body, e.g., ANAB in the United States, UKAS in the United Kingdom, DAkkS in Germany.

International Accreditation Forum (IAF)—The IAF is an association of accreditation bodies. One of its many functions is to provide multilateral agreements (MLA) among accreditation bodies to recognize the certification bodies that each has accredited. Meaning, a CB in the United States accredited by ANAB does not also have to seek accreditation from UKAS if it wishes to audit a UK company. Through the MLA, UKAS recognizes ANAB-certified bodies and vice versa.

CE Mark—CE marking indicates a product has been assessed by the manufacturer and deemed to meet European Union safety, health, and environmental protection requirements.

Notified body—Before using the CE Mark, some products must be tested by a notified body, an organization designated by an EU country to assess the conformity of certain products before being placed on the market. This would include PPE intended for medical purposes.

Example of fake certificate. Click image for larger view.

Spotting fake documents

Agencies are reluctant to talk about their misses and near misses when it comes to counterfeit PPE. Speaking with us off the record, a regional agency in the UK spotted a suspicious vendor as part of its vetting process for vendors of medical-grade masks for its workers. The agency had located a company in China that appeared to have all the necessary documentation to prove it was capable of supplying the masks. Fortunately, it was discovered that much of the documentation was either grossly misleading or outright fraudulent.

One of the first indications was the company’s ISO 13485 certificate. ISO 13485 is a quality management system standard particular to medical devices, and it “specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.” (Emphasis ours.) Purchasers are often required by their companies, customers, or regulatory agencies to purchase medical products only from ISO 13485-certified suppliers.

When asked by the agency to show proof of ISO 13485 certification, Guangdong Fengzhicue Food produced a legitimate-looking certificate issued by the certification body “Certification Europe Hong Kong” and accredited by UKAS (see the sidebar, “Standards certifications terms,” for an explanation of the auditing hierarchy).

As part of its verification process, the UK agency input Guangdong Fengzhicue Food into IAF CertSearch, a global database of accredited management system certifications. The company wasn’t listed. In addition, although the certificate had a UKAS logo on it, Certification Europe Hong Kong did not show in CertSearch as a known UKAS certification body.

CertSearch contains more than 430,000 ISO QMS-registered sites around the world, but it isn’t 100-percent complete. So as further verification, CertSearch administrator, QualityTrade, contacted UKAS. UKAS responded that it looked as though the certificates were fraudulent, adding, “Sadly, we have seen an increase in these type of certificates during the COVID-19 outbreak.”

The problem with Guangdong Fengzhicue Food didn’t stop there. The company also had a misleading document with an FDA logo and a cartoonish U.S eagle-and-flag emblem that implied to a casual observer that the company’s products had FDA approval, which they do not.

This incident isn't an outlier. According to several of our sources, there has been a big spike in fake ISO 13485 and ISO 9001 certificates since the outbreak of Covid-19. Several registrars, such as BSI and DQS, have noted this on their websites. BSI, which is also a notified body for medical products that carry the CE Mark, has also seen a spike in fraudulent CE marks. According to a BSI spokesperson “Whereas we might see a couple or two or three, a few a year, we have started to see an increase. And now we are regularly receiving fake [CE Mark] certificates.”

All of this research was relatively easy to do. Along with using IAF CertSearch and individual databases run by many certification bodies, any purchaser can simply contact certification bodies, accreditation bodies, and testing labs, which will quickly and willingly verify any certification document. (See the list of resources at the bottom of this article.)

Among other checks to keep in mind when purchasing PPE are the following:
• Are product testing documents legit? This is easy to research by contacting the certification bodies, accreditation bodies, or testing labs listed on the certificate.
• Are standards-conformity documents legit? Also easy to research.
• Do you understand the product well enough to recognize if it’s a knockoff or the real thing? If not, hire someone who does.
• Can you trace your shipment all the way back to the manufacturer rather than trusting the distributor? The more companies between the distributor and the actual manufacturer, the more worried you should be.
• Especially for large-volume orders of critical supplies, such as PPE, are you pulling sample lots and testing to ensure they conform to applicable standards?

Liability

There is a liability issue for all of this, and not just for the manufacturer or distributor of fake PPE. If putting workers at risk with fraudulent PPE isn’t bad enough, the company that purchases the PPE could be setting itself up for a lawsuit

When asked if the purchasing company itself could be liable for injuries stemming from fake PPE, Dan Harris, a leading authority on legal matters related to doing business in China, says, “Absolutely. Why not? We are hearing that anywhere from 30 to 60 percent of the PPE coming from China is really, really bad. So bad that you can see holes in them.... Anyone who negligently provides another with something that causes harm is at risk of being found liable.”

Tom Taormina, an expert witness in product liability cases, agrees. “The company that introduces the product into the stream of commerce is liable,” he notes. Furthermore, because it is difficult to litigate in China, the U.S. distributor is usually left holding the bag. “Cases like this are like playing Texas Hold’em,” he says. “The attorneys go back and forth trying to get one of them to bluff or fold. Most of the time, it is too expensive to litigate overseas, and the company that sold [the product] in the United States usually has their insurance pay some kind of settlement.”

There’s plenty of blame to spread

As Stanley Chao points out in his op-ed “This Time, It’s Not All China’s Fault,” the blame doesn’t lie completely on the Chinese (or Thai, or Turkish, or American) counterfeiters. Purchasers themselves are part of the problem. Caveat emptor. The purchaser has the responsibility to research vendors and to understand a product’s requirements. Chao is managing director of All In Consulting, a Los Angeles-based consultancy that helps Western companies do business in China. He says that too many people don’t have a full understanding of dealing with China, and maybe worse, don’t understand what they are ordering well enough to spot a fake.

And as Harris and Taormina point out, if you buy faulty product, even unwittingly, and distribute it to your workers, you are most likely going to be the one who gets sued. That’s why due diligence when researching potential vendors is so important. If you aren’t scrutinizing the vendor and verifying that what you ordered is what you want, you have to shoulder some of blame, says Chao.

In the end, counterfeiters succeed because buyers are ignorant, gullible, or both. The antidote is to arm yourself with as much knowledge as you can, prepare to do legwork and make some calls, and remember that when products are in short supply, be wary of someone all of sudden having plenty of product available.

Following are some resources that can help.

Resources

IAF CertSearch—If you are trying to verify an ISO QMS certification, the first place to look is the IAF CertSearch database. It isn’t yet 100-percent complete, but if your potential supplier’s certification shows up in the database, you know it was issued by an accredited certification body. Currently the database contains data from 68 accreditation bodies, 998 certification bodies, and about 435,000 certificates.

Individual registrar databases—Many registrars maintain publicly searchable databases of their own certifications, BSI, DQS, and DNV GL, for example.

If the registrar listed on the certificate has a database, you can search there, or simply call the registrar and ask for verification. In our opinion, especially for something as critical as PPE, the registrar should be accredited. Accreditation isn’t required or a guarantee of quality, but it is another layer of verification that a company’s quality management system is capable of helping the company make products to applicable standards.

Accreditation body—A certification document will usually show an accreditation body. If you aren’t able to find or contact the registrar listed on the certificate (which should worry you), you can contact the accreditation body.

NIOSH—For masks claiming to have NIOSH approval, CDC maintains a searchable database of NIOSH approvals. In addition, see these NIOSH resources:
• Certified Equipment List Search
• Additional Tips for Spotting Counterfeit Respirators
• Counterfeit Respirators / Misrepresentation of NIOSH-Approval

BSI, the UK’s standards body—A wide range of standards and support documents are available from BSI’s Covid-19 page.

FDA’s Establishment Registration & Device Listing—The FDA maintains a list of “establishments (engaged in the manufacture, preparation, propagation, compounding, assembly, or processing of medical devices intended for human use and commercial distribution) and listings of medical devices in commercial distribution by both domestic and foreign manufacturers.” While being on the list is a must, the truth is anyone can pay $5,236 to be on it. According to the FDA, “Registration of a device establishment, assignment of a registration number, or listing of a medical device does not in any way denote approval of the establishment or its products by FDA.” According to our medical industry sources, if you manufacture noninvasive medical equipment, you could go decades without getting an FDA inspection. So although the medical device manufacturer you are investigating has to be on this list, the fact that it is on the list doesn't mean much.

One of the most common misleading ventures we have come across are companies pretending to have FDA approval by pointing to this listing in an official-looking letter—and maybe throwing in the FDA logo for good measure. The FDA does not allow the use of its logo on company documentation. If you see that logo, be suspicious.

Quality Digest’s editor Laurel Thoennes contributed research to this article.

About The Author