To tell if a DEA number is valid, check three things in order: the nine-character format, a simple checksum on the digits, and the number’s active status in official records. The first two you can do in under a minute with the prescription in front of you. The third requires an official source, because a well-constructed number can still be expired, revoked, or stolen.
Check the Format First
A DEA registration number is always nine characters: two letters followed by seven digits. Anything else is not a DEA number.
The first letter identifies the type of registrant. A, B, and F are used for standard practitioners such as physicians, dentists, veterinarians, and hospitals. M is used for mid-level practitioners, including nurse practitioners and physician assistants. G covers certain Department of Defense contractors. Other first letters designate manufacturers, distributors, researchers, importers, and narcotic treatment programs. If the letter doesn’t fit the type of provider named on the prescription, that alone is a warning sign.
The second letter is almost always the first letter of the individual practitioner’s last name, or the first letter of the business name for an entity like a pharmacy or clinic. When a business name starts with a number (for example, “42nd Street Pharmacy”), the DEA uses the digit 9 in the second position instead of a letter. So if the second character doesn’t match the prescriber’s last name on the prescription, something is off before you even look at the digits.
Run the Checksum on the Seven Digits
The seventh digit of a DEA number is a check digit derived from the six digits before it. If the math doesn’t come out, the number is invalid. Using the sample number AB1234563:
- Add the first, third, and fifth digits: 1 + 3 + 5 = 9.
- Add the second, fourth, and sixth digits, then multiply by 2: (2 + 4 + 6) × 2 = 24.
- Add those two results: 9 + 24 = 33.
- Take the last digit of that sum. Here it is 3. That digit must match the seventh digit of the DEA number. In this example the seventh digit is 3, so the number passes.
If the final digit doesn’t match, the number is definitely fabricated or mistyped. There is no legitimate DEA number that fails this test.
What Passing the Checksum Does Not Prove
A number that passes the checksum is only structurally correct. It could still be expired, revoked, suspended, or stolen from a real practitioner. Someone writing fraudulent prescriptions with a stolen number will pass every arithmetic check you can run, because the number itself is real. The checksum is a first filter. It is not proof that the registration is active or that the person using it is the person it was issued to.
Federal law treats each of those situations the same as an outright fake. Using a DEA number that is fictitious, revoked, suspended, expired, or assigned to someone else is prohibited under 21 U.S.C. § 843, and a pharmacist who fills a prescription tied to such a number shares liability with the person who wrote it.1eCFR. 21 CFR 1306.04 – Purpose of Issue of Prescription That is why the third step matters.
Verify Active Status Through an Official Source
Confirming that a registration is currently active requires checking DEA records. Your route depends on whether you hold a DEA registration yourself.
The DEA Online Portal
The DEA Diversion Control Division runs a Registrant Validation Toolset through its secure online portal. It returns the current status of any DEA registration number. Access is restricted: you have to log in with credentials tied to your own active DEA registration. Pharmacists, prescribers, and other registrants can reach it through the DEA’s CSA Registration Tools page.2DEA Diversion Control Division. CSA Registration Tools Login A patient or member of the public cannot use this tool. There is no public-facing DEA lookup on the agency’s website.
The NTIS Public Database
People without a DEA registration can search the National Technical Information Service database, which publishes Controlled Substances Act registration records. The dataset includes active registrations with DEA numbers and drug schedule codes, plus retired registrant numbers. It covers physicians, dentists, veterinarians, researchers, pharmacies, manufacturers, distributors, importers, and exporters.3National Technical Information Service. Drug Enforcement Administration DEA Monthly Downloadable
Calling the DEA
If the online tools don’t give you what you need, the DEA Registration Service Center takes questions by phone at 1-800-882-9539, weekdays 8:30 a.m. to 5:50 p.m. Eastern, and by email at DEA.Registration.Help@dea.gov. Have the DEA number ready when you contact them.4Drug Enforcement Administration. Registration – Diversion Control Division
Cross-Check the Number Against the Prescriber
An active, well-formed DEA number is still not enough on its own. Match the prescriber’s name, address, and last-name initial against what appears on the prescription and in the registration record. A number that verifies as active but belongs to a different provider, or lists an address unrelated to the practice on the prescription, is a diversion signal. This is where stolen-number schemes tend to break down, because thieves rarely reproduce every identifying detail correctly.
Why Pharmacists Cannot Skip This
For pharmacists, verification is not optional caution. Federal regulations impose what is called a “corresponding responsibility” on the pharmacist filling any controlled substance prescription: the prescriber is primarily responsible for issuing a valid prescription, but the dispensing pharmacist shares liability if the prescription was not issued for a legitimate medical purpose in the usual course of professional treatment.1eCFR. 21 CFR 1306.04 – Purpose of Issue of Prescription Running the checksum, matching the second letter to the prescriber’s last name, and confirming active registration status are how that responsibility is met in practice.
A Quick Order of Operations
Put together, a reliable check looks like this. Confirm nine characters, two letters then seven digits. Confirm the first letter fits the type of provider and the second letter matches the prescriber’s last name. Run the checksum math on the seven digits. Verify active registration status through the DEA online portal, the NTIS database, or a call to the DEA. Cross-reference the prescriber’s name and address against the record. A mismatch at any step is a reason to stop and investigate before dispensing.