Home / Library / The seven tirzepatide scams of 2026, and the checks that defeat them

Safety · the fraud field guide

The seven tirzepatide scams of 2026, and the checks that defeat them

Published 2026-08-14 · 7 min read · By the research team · pending clinician sign-off

The tells, pattern by pattern

No-prescription sellers advertise the absence as convenience ("no doctor visit needed!"); it's actually the confession — tirzepatide is prescription-only everywhere in the U.S., so a seller skipping the prescription is definitionally outside the legal supply chain, whatever the site design suggests. Research-peptide laundering wears lab-coat aesthetics and "RUO" disclaimers while its checkout, dosing content, and community plainly serve human use; independent testing of that channel has repeatedly found underdosed, contaminated, and misidentified product — the full anatomy is in the gray-market dissection. Counterfeit pens ride social-media ads and peer-to-peer marketplaces at too-good brand prices — the FDA has seized fake GLP-1 pens, and the tell stack is price (real Zepbound has a floor; $200 pens don't exist), channel (Lilly sells via pharmacies and LillyDirect, never Instagram), and packaging anomalies. Coupon-harvest sites monetize the search "Zepbound coupon" itself: Lilly issues a savings card through official channels, not retail promo codes, so every code site is farming your email, card number, or click — the real-discount taxonomy lists everything that legitimately lowers price. Impersonators clone real telehealth brands with swapped domains and stolen creative — defeated by typing the known URL yourself rather than clicking ad links. Deposit fraud lives on messaging apps and social groups: friction-heavy payment (crypto, wire, gift cards, peer-to-peer apps) plus urgency plus no verifiable pharmacy equals money gone. And miracle formats are the scam this site is literally named to test: peptide tablets, drops, and gums priced like medicine, marketed on absorption physics their sellers cannot demonstrate — the one-email test settles them in a day.

The 60-second checks, in order of power

Check one — the prescription gate: is a licensed prescriber's evaluation actually required before payment? No gate, no legitimacy, conversation over. Check two — the pharmacy name: a legitimate operation names its dispensing pharmacy; take the name to the state board of pharmacy license lookup (the five-minute workflow in the safety guide). Refusal to name is a verdict. Check three — payment rails: legitimate programs take cards through normal processors (many add FSA/HSA and financing); crypto-only, wire, Zelle-to-a-stranger, or gift cards mark the fraud tier with near-perfect accuracy. Check four — the price-floor test: the real market's verified-and-reported floor sits around $119–199/month for compounded and $299+ for brand ($1,000+ retail pens), so offers dramatically below the floor — $50 vials, $200 'Zepbound' pens — are priced by fraud economics, not pharmacy economics; the ledger is your calibration. Check five — the absorption question for any non-injectable: one email asking for human pharmacokinetic data, which every legitimate product in history can answer and no scam ever has.

If you already paid — or already injected

Money first: dispute the charge immediately (card chargebacks work; wire, crypto, and gift cards mostly don't — which is why check three exists), screenshot everything before the seller's site or chat disappears, and change any credentials shared. Reporting, which genuinely matters at scale: the FTC (reportfraud.ftc.gov) for the fraud itself, the FDA's MedWatch and illegal-sales channels for the product, the platform where the ad ran, and your state board of pharmacy if a 'pharmacy' was impersonated. Health second and more important: if you injected a product from a failed-check source, stop, keep the vial and packaging (evidence and, if symptoms arise, identification), and loop in a clinician — most gray-market product is underdosed rather than acutely toxic, but 'most' is not a safety standard, and symptoms out of proportion to expected effects are urgent-care territory per the triage tiers. Then run the shame-deletion protocol: these operations are professionally engineered against people under real medical and financial pressure, the checks above exist because the scams work on smart people, and the most useful response is the report that helps the next person's search results.

Anatomy of one scam, end to end

Composite the patterns into a single walkthrough and the machinery becomes unforgettable. It starts with a social ad — a before/after, a price that undercuts the market's floor by half, urgency ("supply secured this week only"). The landing page wears borrowed legitimacy: stock lab imagery, an "FDA-registered facility" line (registration ≠ approval — the glossary's most abused term), a COA badge that enlarges into an unverifiable JPEG, testimonials with stolen photos. The checkout is where the tells concentrate: no intake beyond an email, payment via Zelle or crypto "for your discount," and a countdown timer restarting on refresh. Post-payment, the script forks: the pure-fraud branch ships nothing and stops answering; the gray-market branch ships a vial with a research-use label and no beyond-use date, sourced from the supply chain the gray-market dissection maps; the slow-bleed branch delivers once, then auto-bills against terms you never saw. Now replay it against the five checks and watch every stage fail on contact: the missing prescription gate kills it at the landing page, the unnameable pharmacy kills it at the FAQ, the payment rails kill it at checkout, the price killed it in the ad itself. The walkthrough's lesson isn't vigilance-as-anxiety — it's that the entire architecture is optimized against people who haven't pre-decided their checks, and collapses instantly against people who have.

Protecting the people around you

The highest-risk person in your life is usually not you — it's whoever combines motivation, unfamiliarity with this market, and a social feed full of these ads. The family briefing, in one conversation: the drug is prescription-only everywhere (any "no doctor" offer is the whole answer), real prices have a floor (share the ledger so "cheap" has a calibration), payment method is destiny (cards only, ever), and "ask me before you pay anyone" costs nothing and catches almost everything. For the parent or relative already mid-purchase: skip the lecture, run the checks together in five minutes — the pharmacy-lookup step in particular converts an argument about trust into a shared fact-finding exercise, which is the only version that works. For the community layer: report the ad on the platform every time (platform takedowns are the one intervention that scales), and know that the FTC and FDA channels from the previous section genuinely feed enforcement patterns even when no individual case gets pursued. And the cultural contribution this whole site is built on: normalize the question "how do you know they're legit?" as ordinary due diligence rather than paranoia — because the scam economy's real substrate isn't gullibility, it's the social awkwardness of checking, and that's a substrate any of us can help drain.

The gray zone: aggressive marketing versus actual fraud

Between legitimate programs and outright scams sits a broad band this guide would be dishonest to skip: real companies using scam-adjacent tactics. The inventory, from our own audits: countdown timers and welcome-back popups on real telehealth sites; efficacy claims exceeding the trials (a live example sits documented in our own partner's audit file — the "up to 24.3%" claim we logged against SURMOUNT-1's 20.9%); intro prices whose renewal terms hide (Embody's repricing history and conflicting cancellation windows, all sourced on its verification file); ranking badges from sites the ranked company controls; and "microdose" tiers marketed below the evidence. None of these make a company a scam — the prescription gate, real pharmacy, and real product distinctions hold — but they're the same psychological machinery at lower voltage, and they justify the same defenses: screenshot the checkout, get renewal and cancellation terms in writing, calibrate every claim against the trial numbers and the price ledger, and weight a company's marketing honesty as real information about how it will treat you at cancellation time. This band is precisely why the verification files exist as a genre between "legit" and "scam" — because the honest answer for most of this market is "real, with flags," and flags deserve documentation, not just adjectives.

The sixty-second summary

Every scheme in this file — and every scheme invented after it — fails the same five questions: Is a real prescriber evaluation required? Can the pharmacy be named and license-checked? Do payments run on normal card rails? Does the price clear the market's real floor? Will they document absorption claims on request? Ask them in order, stop at the first failure, and teach the list to one person who'd never think to ask — that last step is the only intervention here that compounds.

FAQ

How do I know if an online tirzepatide pharmacy is legit?

Three checks: a real prescriber evaluation is required, the dispensing pharmacy is named and verifiable in your state's license lookup, and payment runs through normal card processing. Failing any one is disqualifying.

Are cheap Zepbound pens on social media real?

Assume counterfeit. Lilly distributes only through pharmacies and LillyDirect; the FDA has seized fake GLP-1 pens sold via social ads, and real pens don't exist at too-good prices.

Is there a real Zepbound coupon code?

No retail promo codes exist. Lilly's real discount is its savings card via official channels (as low as $25 with eligible commercial coverage); 'promo code' sites are harvesting your data.

Related: The safety verification workflow · The one-email tablet test · Real discounts vs coupon theater · Gray-market anatomy

Educational content, not medical advice — dosing, switching, and side-effect decisions belong with your prescriber. Sources and trial citations: the source library. Corrections within 48 hours: policy.