Skip to content

Banks, Payfacs, and ISOs Need to Know These Three Principles for Online Pharmacies

internet pharmacy guide overview

Illicit online pharmacies selling counterfeit, unapproved, or otherwise unsafe drugs pose some of the greatest threats to consumer safety in e-commerce. Acquirers, payment facilitators, and ISOs can mitigate this risk by learning more about card network rules for high-integrity risk merchants selling pharmaceutical products. Learn about the three principles of internet pharmacy legitimacy below, then download LegitScript’s 13-page Internet Pharmacy Guide to learn how to conduct a thorough investigation that reduces your risk.


Card Networks Deem Merchants Selling Pharmaceuticals or Other Drugs as High-integrity Risk

Visa and Mastercard deem anyone processing payments for merchant category codes (MCC) 5122 and MCC 5912 as high-integrity risk. Regulatory scrutiny surrounding the online sale of illicit drugs heightens the importance of enforcing non-compliance policies. Ensuring your merchants comply starts with understanding how Visa and Mastercard define these high-integrity risk MCCs.

MCC 5122

According to the latest Merchant Data Standards Manual, Visa labels MCC 5122 as Drugs, Drug Proprietaries, and Druggist Sundries stating, “Merchants classified with this MCC are business-to-business or wholesale distributors of prescription drugs, proprietary drugs, druggists’ sundries, pharmaceuticals, and biological or related products.”

While both card networks' definitions for the MCC code are analogous, centering on wholesale distributor(s) of prescription drugs, Mastercard adds “vitamins, toiletries, antiseptics, bandages, pharmaceuticals, biological or related products” to its definition.

MCC 5912

Both Visa and Mastercard label MCC 5912 as Drug Stores and Pharmacies and define their products as prescription or proprietary drugs. Mastercard’s definition also includes nonprescription (over-the-counter) medicines and categorizes the MCC as intended for a miscellaneous store.

Quickly Vet Merchants by Understanding the Three Principles of Internet Pharmacy Legitimacy

There is a remarkable degree of global consistency on the fundamental principles of internet pharmacy operations. If an internet pharmacy is violating any one of the principles below, it is usually operating unlawfully.

  • Licensure: Pharmacies need to be licensed or registered where they are located and where they offer to ship drugs. Some jurisdictions accept other jurisdictions’ licenses.
  • Prescriptions: Selling prescription drugs without requiring a valid prescription is unlawful. Even with the growth of telemedicine, simply filling out an online form without a consultation is rarely considered an appropriate basis for a valid prescription.
  • Shipping: Internet pharmacies are unable to ship prescription drugs that are unapproved and/or drugs that are deemed unsafe and ineffective by the agency in the customer's jurisdiction. The majority of countries have an approved prescription drug list available to the public.

As with any rule, policy, or law, there may be exceptions. However, knowing these three principles will help you assess a merchant’s validity and compliance in most cases.

LegitScript Healthcare Certification Can Help

LegitScript Healthcare Certification provides a recognized stamp of approval for businesses that facilitate the sale of pharmaceuticals. The certification process helps online pharmacy merchants meet the required compliance and best practice standards and enables them to promote their business and process payments. Both global advertising networks and major card brands recognize LegitScript-certified high-risk merchants.

Payment services providers can partner with LegitScript for healthcare certification to:

  • Confidently onboard high-risk pharmacy merchants on your payments platform.
  • Ensure high-risk pharmacy merchants are operating in compliance with jurisdictional laws wherever they operate and demonstrate best practices per industry standards.
  • Comply with card brand rules, enhance credibility and trust, increase market access, and mitigate risk.

Download our Internet Pharmacy Guide to understand the fundamental rules around the sale of pharmaceuticals online and discover tips your risk and compliance teams can use to develop policies and procedures to stay compliant.

Internet Pharmacy Guide

Understand the rules around the sale of pharmaceuticals online in the US and in most countries around the world, then get insight on developing policies and procedures to stay compliant.

Internet-Pharmacy-Guide-Thumb

Smelting words into a specialty since 2020, Thea Le Fevre specializes in B2B SaaS Content Marketing. Take a deep dive into her work for up-to-date industry news surrounding issues in payments risk & compliance, trust & safety, regulatory compliance, and more.

Recent Blog Articles

Deepfake; Real Risk: The Crackdown on AI Image Generators

AI has transformed how people create and share digital content. But as AI tools evolve, they're also creating new compliance and reputational risks. LegitScript has seen an increase in card network scrutiny related to AI image generation and deepfakes. Our analysts are monitoring the swiftly changin...

Where Policy Meets Performance: Winning in Healthcare Advertising Post-Certification

Why LegitScript Certification Matters for Healthcare Advertising For many healthcare providers, earning LegitScript Certification is a major milestone. It's the key that unlocks advertising on platforms like Google and Meta, two of the most powerful digital channels for reaching patients. Certificat...

Key Takeaways from the 2025 Marketplace Risk New York Conference

The 2025 Marketplace Risk New York Conference proved that marketplaces and platforms are no longer simply about connecting buyers and sellers. They are about creating safe, trusted environments where commerce can thrive. For trust and safety, compliance, legal, and product professionals, the message...

Why the Next 6 Months Will Redefine Merchant Risk Management

Two deadlines. One turning point. On October 1, 2025, enforcement begins on the Visa Acquirer Monitoring Program (VAMP). Just three months later, on January 1, 2026, Mastercard's Merchant Monitoring Program (MMP) revised standards take effect. Together, these updates mark one of the most significant...