Lilly Asks Card Firms to Cut Off Retatrutide Sellers

Eli Lilly and Company has asked the payment industry to help shut down sales of retatrutide, its experimental obesity drug, and the pressure is reaching online merchants from two directions. On August 12, 2026, Lilly sued a compounding pharmacy, a med spa, and four online peptide sellers in federal court, and in the same announcement said credit card companies, payment processors, and shipping carriers “must cut off the infrastructure enabling this illegal trade.” Five weeks later, a CBS News investigation found more than 80 businesses promoting retatrutide while displaying LegitScript certification, a credential LegitScript says Visa and Mastercard recognize when pharmacy and telehealth merchants register as high-risk.

The lawsuit allegations have not been proven, and one defendant, Legendary Peptides LLC, asked a Texas federal judge on October 2 to dismiss Lilly’s case against it. For telehealth brands, compounding pharmacies, and med spas that take cards for prescription weight-loss drugs, the nearer-term effect is likely to come from acquirers and certifiers taking a harder look at their own files.

What Lilly asked payment companies to do

Lilly’s release describes retatrutide as “an investigational molecule in Phase 3 clinical trials for obesity, type 2 diabetes and other related indications” and says no medicine containing it “has yet been approved for human use by any regulatory agency in the world.” The U.S. Food and Drug Administration (FDA) says on its page on unapproved GLP-1 drugs that retatrutide “cannot be used in compounding under federal law” and that it has “not been found safe and effective for any condition.”

Alongside the lawsuits, Lilly said it had referred more than 200 individuals and entities to the FDA, the Department of Justice, state attorneys general, law enforcement, and professional licensing boards. It also said it had reported more than 14,000 websites, ads, social media posts, and product listings in over 100 countries to internet service providers, social platforms, and e-commerce companies. The release puts card companies and processors on its list of businesses that should act, but it does not say whether Lilly has filed reports with any card network or acquirer. EC4IM found no public statement from Visa or Mastercard answering the request.

The complaints lean on earlier FDA action, including the agency’s March 3, 2026 warning letters to telehealth companies over compounded GLP-1 marketing, which EC4IM covered in FDA Warns 30 Telehealth Firms Over Compounded GLP-1 Marketing Claims.

The six lawsuits and where they stand

Lilly’s release and the federal dockets identify six cases, all filed August 12:

Eli Lilly and Company v. Aesthetic Envy Cosmetic Centers LLC, against a Sacramento-area med spa, docketed in the Eastern District of California (Lilly’s release lists the Northern District)
Eli Lilly and Company v. Astra LLC, doing business as Astra Peptides, in the Western District of Texas
Eli Lilly and Company v. Legendary Peptides, LLC, in the Eastern District of Texas
Eli Lilly and Company v. Striker Pharmacy, LLC, in the Southern District of Texas
Eli Lilly and Company v. Texas Peptides Inc., in the Western District of Texas
Eli Lilly and Company v. Lone Star Peptide Co. LLC, in the Southern District of Texas

These are civil cases. The Texas complaints EC4IM reviewed rest on state consumer protection and unfair competition laws, while the Aesthetic Envy complaint adds a federal false advertising claim under the Lanham Act. The Lone Star Peptide complaint shows how Lilly frames the peptide sellers. It quotes the site’s own disclaimers that products are “strictly for in vitro laboratory research use only” and “not for human or animal administration,” then points to a retatrutide dosage calculator, step-by-step mixing instructions with bacteriostatic water, and the owner’s TikTok posts as evidence that the products were sold for people to inject.

Striker Pharmacy sits closest to the licensed supply chain that telehealth brands depend on. Its website calls it a “Licensed Sterile Compounding 503A Pharmacy,” and the complaint describes it as a compounding pharmacy in Katy, Texas. Lilly alleges that Striker compounds retatrutide, sells it to medical practices including med spas, and ships it directly to consumers while keeping it off its public website. According to the docket, Striker appeared through counsel on October 1 and two days later filed an unopposed motion for more time to respond.

Legendary Peptides is contesting the suit. Its motion to dismiss opens with the line “Lilly does not sell retatrutide, and on its own allegations it cannot.” The company argues that Lilly lacks standing because its approved medicines, Mounjaro, Zepbound, and Foundayo, are made from different molecules, that Lilly’s lost-sales theory rests on two anonymous Reddit posts that do not mention Legendary, and that Texas does not recognize the common-law unfair competition claim Lilly pleaded. None of the docket entries EC4IM reviewed shows a ruling on the merits in any of the six cases.

What CBS News found behind the LegitScript seal

The CBS News investigation, reported by Daniel Gilbert and published September 16, traced retatrutide ads on social media back to the businesses selling the drug. It found more than 80 businesses that “apparently flouted LegitScript’s rules while touting its seal of approval,” including at least 35 that showed their certification on the same page where they promoted retatrutide. One advertised the drug with a vial labeled “Legit. Script. Certified.”

LegitScript, a Portland, Oregon company, certifies online pharmacies and telehealth providers, and its approval is one of the only ways to advertise prescription drugs and telehealth care on Facebook, Instagram, Google, YouTube, and LinkedIn, CBS reported. Scott Roth, LegitScript’s chief executive, told CBS the firms it identified were a tiny fraction of those LegitScript certifies and “were all flagged as part of our monitoring process.” Some gave up their certification, some were suspended, and the rest made changes or were in the process of doing so, he said. “Our policy is not to immediately revoke the certification in all instances,” Roth said.

Several findings bear on how payment partners use the seal. CBS reported that LegitScript generally relies on publicly available information and cannot readily see what happens behind a login. One telehealth platform, Pepti, took down its public retatrutide page but kept offering the drug to subscribers for at least another week, according to time-stamped screenshots CBS reviewed. CBS also linked 280 wellness storefronts advertising retatrutide to OutfitMD, a company that connects entrepreneurs with prescribers and pharmacies, after finding that the stores listed the same phone number and the same “account for processing payments,” both belonging to OutfitMD according to the sites’ source code. OutfitMD’s certification was active as recently as June, but it no longer appears in LegitScript’s database, CBS reported. OutfitMD did not respond to CBS.

What LegitScript’s standards say about retatrutide

Six days after the CBS story, LegitScript published a September 22 post by Naomi Moono setting out its position. Retatrutide, BPC-157, TB-500, and cagrilintide are “not currently eligible for compounding, sale, or use” in the United States, the post says, and certified businesses break its standards not only by dispensing or prescribing them but also by “offering the product, promoting it, or advertising it.” Routing the prescribing or dispensing through a partner “doesn’t provide a workaround either.”

LegitScript’s Healthcare Merchant Certification FAQ calls the program “a necessary part of the approval process for conducting card-not-present transactions with Visa and Mastercard.” The same page lists “research-use-only chemical businesses (including peptides)” among businesses generally not eligible, and puts the cost at a $975 application fee plus $2,150 a year for each root domain.

Analysis: why licensed merchants sit close to the fallout

Analysis. Visa treats card-absent sales under merchant category codes (MCCs) 5122, for drugs and druggist sundries, and 5912, for drug stores and pharmacies, as “high integrity risk,” according to its April 2026 Merchant Data Standards Manual. Visa’s 2015 Online Pharmacy Guide for Acquirers, produced with LegitScript, lists the sale of drugs “considered ‘unapproved’ in the patient’s jurisdiction” among four primary types of illicit behavior by rogue internet pharmacies. A retatrutide product page fits that description whatever label sits on the vial.

When an acquirer closes an account over that kind of activity, the networks’ terminated merchant files can follow. Stripe’s documentation on terminated merchant files lists “Illegal Transactions” as reason code 13 in Mastercard’s Member Alert to Control High-Risk Merchants (MATCH) database and as code 24 in the Visa Merchant Screening Service (VMSS), and says listings stay active for five years and include principal owners. The networks do not publish these lists, and EC4IM has no information that any company named in this article has been placed on one. The exposure for a merchant is that a termination tied to an unapproved drug travels with the business and its owners to the next application, a problem EC4IM described in What Happens After a High-Risk MID Termination and How to Rebuild Processing.

A license does not settle the question on its own. One of Lilly’s six defendants advertises itself as a licensed 503A pharmacy, and CBS found retatrutide offered by certified telehealth firms and by a certified compounding pharmacy in Florida. FDA is reading telehealth storefronts closely too; its September 18 warning letter to Empower Pharmacy took issue with preselected menu options in telehealth prescription workflows for compounded GLP-1 drugs, as EC4IM reported in FDA Warning Letter Flags Empower Pharmacy Compounded GLP-1 Telehealth Menus. Any business shopping for telemedicine processing after the CBS report, on Organic Payment Gateways or directly with a bank, should expect the underwriter to pull its current entry in LegitScript’s database rather than trust the badge in its footer.

Analysis: what acquirer reviews are likely to cover

Analysis. Neither Visa, Mastercard, nor LegitScript has published a retatrutide checklist for acquirers. Drawing on the lawsuits, the CBS findings, and LegitScript’s stated rules, these are the areas EC4IM expects risk teams to probe, and the records that can separate a licensed merchant from the sellers Lilly is suing:

Catalog names and code names. FDA’s March 31 warning letter to Gram Peptides says the firm sold retatrutide as “GLP-1-R peptide,” so a search for the drug’s name alone can miss a listing. A formulary limited to FDA-approved drugs and substances eligible for compounding gives an underwriter something to compare against the live site.
Pages behind a login. The Pepti example shows a public page can come down while a patient portal keeps selling. Portal screenshots or test credentials answer that question before a reviewer asks it.
Intake forms and partners. CBS traced ads to questionnaires hosted on third-party telehealth software, and LegitScript says prescribing or dispensing by a partner counts against the certified business. Pharmacy and prescriber agreements that exclude investigational drugs speak to that rule.
Who owns the merchant account. Stripe’s summary of VMSS codes includes one for merchants that submit transactions on behalf of another merchant, so a single processing account behind many storefronts invites questions about which businesses are actually selling.
Current certification status. CBS found firms still showing the LegitScript shield after they had dropped out of the database, which makes a dated database lookup stronger evidence than a badge screenshot.

What remains unknown

Lilly has not said publicly which payment companies, if any, have acted on its request. LegitScript has not published how many certifications it suspended or revoked after the CBS inquiry, beyond Roth’s account and the individual suspensions CBS documented. In court, Lilly’s response to Legendary Peptides’ motion is the next filing to watch, and Striker Pharmacy has asked for more time to respond. EC4IM did not seek comment from Lilly, LegitScript, or the defendants for this article.

Retatrutide pressure moves into the merchant file

Lilly paired six early-stage civil lawsuits, one already met with a motion to dismiss, with a direct request that card companies and processors stop serving retatrutide sellers. CBS then showed that the LegitScript seal, which LegitScript says Visa and Mastercard recognize in high-risk registration, appeared on dozens of sites selling the drug, and LegitScript’s September 22 guidance restated that offering, promoting, or partnering on retatrutide breaks its standards. No card network has announced a response. For licensed telehealth brands, 503A pharmacies, and med spas, the likely result is closer scrutiny of what their catalogs, patient portals, partners, and merchant accounts contain, and a file that documents each of those is the clearest way to stand apart from the sellers Lilly named.

Eli Lilly Presses Card Companies and Processors to Cut Off Retatrutide Sellers