How to Check if an Online Pharmacy Is Legit

Key facts

• FDA says a safe online pharmacy always requires a prescription. A site selling prescription medicine without one fails the first check.
• If a pharmacy is not listed in your state board's license database, FDA says not to use it.
• A seal on a website is not enough by itself. Search the web address with LegitScript or NABP instead.
• The Federation of State Medical Boards' model policy says a physician treating you online must be licensed or authorized by the board of the state where you are located, with a few exceptions.
• These checks cover the seller, not the medicine. Compounded medicines are not FDA-approved.

1. Confirm it requires a prescription

FDA's first sign of a safe online pharmacy is that it always requires a prescription. If a site sells prescription medicine without one, stop here. The National Association of Boards of Pharmacy (NABP) names this among the things websites on its Not Recommended list commonly do.

On a telehealth site, the prescription should come from a licensed provider who can ask you follow-up questions. The Federation of State Medical Boards (FSMB) says in its telemedicine policy, a model for state boards rather than a law, that prescribing based solely on a static online questionnaire is not acceptable.

2. Look up the pharmacy's license

FDA's lookup page lists a license search for each state's board of pharmacy. Some of its links are out of date or open the board's main page, so if one fails, use NABP's directory of boards. Search the pharmacy's own name, which may differ from the website's brand. If it is not listed, FDA says not to use it.

NABP says a legitimate online pharmacy is licensed where it is located and where the patient is, and that each state requires a license from pharmacies inside and outside its borders. So a pharmacy shipping to you from another state should still be licensed in yours.

Many telehealth sites do not fill prescriptions themselves. A separate pharmacy does. Ask the site which one, or read its policies. Under federal law, a dispensed prescription label generally shows the dispenser's name and address, so you can run this check again when your order arrives.

3. Check the website, not the seal

The Federal Trade Commission (FTC) warns that official looking seals and logos can be faked. LegitScript, which certifies healthcare websites, says its own seal on a site is not enough by itself to confirm current certification, because a business may keep showing it after losing certification. Search the web address directly:

• LegitScript. Enter the address in its website status check. Certified means LegitScript vetted the site and monitors it on an ongoing basis. Legitimate means another body it recognizes, such as NABP, accredited the site. Rogue means the site's primary purpose is illegal, unsafe or misleading activity.
• NABP. Enter the address in its Safe Site Search to see whether NABP accredited the site or lists it as Not Recommended. NABP says it has identified more than 40,000 websites that fail its standards or applicable laws.
• The web address itself. NABP says a website ending in .pharmacy has been accredited by NABP, and that unlike a logo, this ending cannot be faked.

A site may appear on neither list. That does not prove it is unsafe, and it does not clear it either. NABP's accredited list includes only sites that have earned its accreditation, and NABP asks people to report suspicious sites it has not yet listed. The license check in step 2 still applies.

4. Check the provider's license

FSMB's policy says a physician must be licensed or appropriately authorized by the medical board of the state where the patient is located, with a few exceptions, because medicine is practiced where the patient is at the time of care. Ask the site for your provider's name. A dispensed prescription label generally shows the prescriber's name too. Then look the provider up:

• Your state medical board. FSMB keeps a directory of state medical and osteopathic boards. FSMB says board profiles include, at a minimum, license status and disciplinary history.
• DocInfo. DocInfo is FSMB's free national search. It covers physician disciplinary actions, license history, medical school and type of degree.
• The NPI Registry. The federal NPI Registry lets you search providers by name, specialty and location. CMS says having a National Provider Identifier does not ensure a provider is licensed or credentialed, so use it to confirm a name and use the state board for the license.

For a nurse practitioner, try the free Nursys lookup. Nursys says only some boards send it advanced practice licenses, so if nothing appears, check with the state board of nursing.

5. Find a real address, phone number and privacy terms

FDA's signs of a safe online pharmacy include a physical address and telephone number in the United States, and a licensed pharmacist on staff to answer your questions. A telehealth site may not employ a pharmacist itself, so ask the pharmacy that fills the order.

Read the privacy terms before you enter health or payment details. FDA flags sites that give no clear written protections for your personal and financial information, and sites that sell your information to other websites.

6. Watch for the warning signs

FDA and NABP warn about these signs of an unsafe seller:

• Deep discounts, prices that seem too good to be true, or offers of bonus pills
• Payment by cryptocurrency or peer-to-peer methods only
• Charges for products you never ordered or received
• Medicine that looks different from what you receive at your local pharmacy
• Packaging that is broken, damaged, in a foreign language, expired or missing an expiration date

NABP also warns that buying prescription medicine through social media can put you at risk, and that scammers use AI deepfakes to impersonate licensed physicians and clinics and to create fake testimonials. Its advice on any ad is to check the pharmacy, not just the ad.

What these checks do not tell you

A license or certification tells you about the seller. It does not tell you whether a medicine is FDA-approved or right for you. Compounded medicines are not FDA-approved, and FDA says it does not verify their safety, effectiveness or quality before they are marketed. State boards of pharmacy generally handle day-to-day oversight of state-licensed pharmacies.

Before you order, ask whether the product is FDA-approved or compounded. When it arrives, check that the label names the pharmacy you looked up, and ask a pharmacist or your provider about anything that looks wrong.

If a site fails a check

Do not order from it. You can report it to any of these:

• FDA's report page for sales of medicine by unsafe online pharmacies
• LegitScript's report page or NABP's report link
• Your state board of pharmacy or state medical board

If you already took something from the site and had a bad reaction, contact a licensed provider and report it to FDA's MedWatch program. In an emergency, call 911.

Who wrote this guide

CHROMA23® wrote this guide and has a stake in the subject. It is a telehealth platform, not a pharmacy. Independent providers make prescribing decisions, independently licensed pharmacies fill prescriptions, and some of the medicines offered are compounded. Check this site the same way you would check any other: partner pharmacies are listed in the Prescription Policy, and the company's address and phone number are in the Terms of Service.

Frequently asked questions

About CHROMA23®

CHROMA23® brings weight loss, longevity, sexual health, hair, and skincare into one place. Every prescription decision is made by an independent provider licensed in the patient's state, where available, and every medication is dispensed by a state-licensed pharmacy. The assessment is free. One clear price per plan, shown in full before you pay. The medicine is real. The provider is real.

Sources

1. FDA: Considering an online pharmacy? (BeSafeRx)
2. FDA: Locate a state-licensed online pharmacy
3. FDA: How to buy medicines safely from an online pharmacy
4. FDA: Compounding and the FDA, questions and answers
5. NABP: Buy safely
6. NABP: Boards of pharmacy
7. LegitScript: Website certification status
8. LegitScript: Merchant and website classifications guide
9. LegitScript: What the certification seal means and how to verify it
10. FTC: Buying health products and services online (2011)
11. FSMB: The appropriate use of telemedicine technologies in the practice of medicine (2022)
12. FSMB: Information for consumers (2020)
13. FSMB: Contact a state medical board
14. CMS: The National Provider Identifier fact sheet
15. NPPES: NPI Registry search
16. Nursys: QuickConfirm license lookup, questions and answers
17. 21 U.S.C. 353(b)(2): prescription label requirements

Keep reading