Food fraud isn’t new, and I don’t know that it’s actually gotten worse over the years. What’s changed is our awareness of it. At its core, food fraud is the intentional substitution, addition, tampering, or misrepresentation of a food or ingredient for economic gain. The drivers haven’t changed much: high-value ingredients, complex global supply chains with more intermediaries than most people realize, price volatility from tariffs or natural disasters, and food safety standards that vary from country to country. Put those together and food fraud is going to keep happening. The question is how well The question is how well companies understand where they’re vulnerable and what they’re doing to reduce that risk.companies understand where they’re vulnerable and what they’re doing to reduce that risk.

I spent 24 years at FDA before retiring in 2025, and this issue followed me through most of that career. I got pulled into response and traceback work on some of the most significant food fraud events involving FDA-regulated products, including the melamine-in-infant-formula crisis, the Peanut Corporation of America case, and, near the end of my time there, the lead contamination of cinnamon that made its way into applesauce pouches sold across the U.S. That last one is worth walking through in detail because it’s a case study in exactly where our current traceability infrastructure falls short, and why that matters.

From Cinnamon Sticks to Lead Chromate

The cinnamon sticks at the center of this case originated in Sri Lanka. From there they were exported to Ecuador, passing through several intermediaries along the way, likely bought and sold more than once, before one of those intermediaries ground the sticks into powder. It was during that grinding step that lead chromate was introduced into the cinnamon.

Why lead chromate specifically? Because the product was being valued primarily based on two things, color and weight, and lead chromate enhances both. It’s the same motive behind decades of similar cases: lead chromate showing up in Hungarian paprika in the 1990s, in turmeric in Bangladesh and India. The objective wasn’t to cause harm. It was to make a cheaper product look and weigh like a more valuable one and get paid accordingly.

That contaminated cinnamon was sold to a processor in Ecuador, Austrofood, that used it to produce applesauce. The finished product was imported into the U.S. by a company called WanaBana and distributed nationally. CDC identified 566 cases of elevated blood lead levels associated with consumption of the pouches, approximately 96% of them in children under six. Nearly 3 million pouches were recalled, and WanaBana filed for Chapter 7 bankruptcy protection within months.

Why This Case Sticks With Me

Of the cases I worked, the Peanut Corporation of America investigation remains the most complex traceback I was ever part of. A single contaminated peanut paste ingredient had worked its way into literally hundreds of products, and untangling that took an enormous amount of manual effort. The cinnamon case was complex in a different way. It wasn’t about how many finished products contained the ingredient. It was about how many countries, companies, and hand-offs the ingredient itself passed through before anyone in the U.S. ever saw it: a grower in Sri Lanka, an exporter, several intermediaries in Ecuador, the grinding operation that FDA had no direct relationship with and no visibility into, a finished-goods processor, an importer, and multiple national distributors. Every additional hand-off adds another place where visibility can be lost and another party a company may know very little about.

FDA didn’t stop at identifying where the contamination happened. The warning letter to Austrofood, the Ecuador-based manufacturer, lays out the part I think is the real lesson here. Austrofood had actually flagged lead as a potential hazard twice before the recall, once in a 2022 hazard analysis covering raw materials generally and again in 2023 when it specifically named the cinnamon ingredient, and both times concluded a preventive control wasn’t necessary. The justification the second time was that the supplier had no history of problems. FDA’s response was direct: given how often lead turns up in spices, and given that this product was intended for infants as young as six months, a knowledgeable person should have reached the opposite conclusion.

There’s another interesting detail buried in the warning letter. Austrofood’s own supply chain program required an annual onsite audit of its Ecuador-based suppliers, including Negasmart, the distributor that supplied the contaminated ground cinnamon. That onsite audit never happened. Austrofood substituted what the letter calls a “desk audit,” a paper review, which FDA noted wasn’t consistent with the company’s own supply-chain program. When FDA tested the cinnamon from that supplier directly, it found lead as high as 5,110 parts per million, along with extremely high chromium levels. Further analysis identified lead chromate in the cinnamon rather than incidental lead contamination. Lead chromate doesn’t turn up in cinnamon by accident.

None of that is really a traceability problem. It’s a prevention problem. Austrofood had information that should have led to stronger supplier controls before the contaminated cinnamon ever reached the applesauce. But once prevention fails, traceability determines how quickly you can figure out where a product came from, where it went, and what else may be affected.

Where FSMA 204 Doesn’t Reach

Here’s the part I think gets missed in a lot of the traceability conversation right now. There’s a lot of attention on FSMA 204, FDA’s food traceability rule, and rightly so, particularly in light of a string of high profile foodborne illness outbreaks this year. But that rule applies specifically to foods on FDA’s Food Traceability List, and a lot of the products that show up again and again in food fraud cases simply aren’t on it. Spices are a good example. Cinnamon isn’t on the list, and neither are a lot of the other high-value, high-fraud-risk commodities that keep showing up in incident after incident. If your compliance program stops at the FTL, you have no visibility into exactly the categories most likely to be defrauded.

So companies that are only building traceability programs to satisfy the letter of FSMA 204 are going to have blind spots in some of the very categories that repeatedly show up in food fraud cases. That’s not a shortcoming of FSMA 204; it wasn’t designed as a food fraud prevention rule or as a universal traceability requirement. But it does mean companies shouldn’t treat FSMA 204 compliance as the endpoint of their traceability programs. This is particularly true for ingredients like spices and honey that show up year after year in global fraud reporting but aren’t covered by the FTL.

Buying Down the Risk

There isn’t one control that’s going to prevent food fraud. What companies are really trying to do is buy down risk. The starting point is recognizing that food fraud is a business risk in the first place, separate from the microbiological and chemical safety risks most food safety programs are already built around.

That risk also changes over time. A commodity that looks relatively low-risk today may look very different after a crop failure, a sudden price increase, new tariffs, or instability in a major sourcing region. Horizon scanning can help companies see those pressures developing and ask where they may be creating new incentives for fraud.

A food fraud vulnerability assessment brings that down to the ingredients and products a company actually buys. Where does an ingredient come from? How many hands does it pass through? Does it have a history of adulteration? Is there an inexpensive way to make it look better, weigh more, or otherwise appear more valuable than it really is? From there, supplier audits and targeted testing can help address the vulnerabilities you’ve identified, although neither eliminates the risk.

Traceability plays a different role. A traceability system wouldn’t have stopped someone in Ecuador from grinding lead chromate into cinnamon to make it heavier and brighter. That’s what the preventive side of the equation is for. But when prevention fails, traceability determines how quickly you can figure out where an ingredient came from, where it went, and what else may be affected. For cinnamon and other high-value ingredients moving through complex global supply chains, that’s worth knowing even when a regulation doesn’t require you to.

The Data Has to Move

The cinnamon case raises a broader question for the food industry: How well do we really understand the journey of an ingredient before it reaches the consumer?

As ingredients move through multiple suppliers, countries, and systems, information can become fragmented. Companies may have the records they need within their own operations, but connecting that information across the supply chain is often a different challenge.

Across the food supply chain, companies already generate enormous amounts of data. The challenge isn’t necessarily a lack of information. It’s that the systems holding that information often weren’t designed to communicate with one another.

A grower may have visibility within its operation. A processor may have the records it needs within its facility. Distributors and retailers may each maintain their own information. Yet gaps can still exist between those systems and trading partners, making it difficult to piece together the complete journey of an ingredient or finished product.

At Starfish, we see this challenge across the food supply chain. Companies often have the information they need within their own operations, but connecting that information across trading partners remains difficult. The next phase of traceability isn’t simply about collecting more data or introducing another technology platform. It’s about making the information companies already generate more accessible and useful across the supply chain.

This is where interoperability becomes important. The ability for different systems to exchange and use information, without requiring everyone to operate on the same platform, can help close gaps in supply chain visibility.

Better connected data won’t prevent someone from intentionally adulterating an ingredient. But it can strengthen supply chain visibility, support investigations, and help companies identify where affected products have moved.

FSMA 204 is helping advance the industry toward more structured, accessible traceability information. But the opportunity extends beyond the foods covered by the rule.

The bigger question isn’t simply whether companies have traceability data. It’s whether they can access and share that information across their supply chains when it matters most.

Learning From the Past

The food industry has decades of experience to learn from. Investigations like the cinnamon case have exposed vulnerabilities in supplier oversight, preventive controls, and visibility across complex supply chains.

Yet many of these same challenges continue to surface. Information remains fragmented, companies struggle to see beyond their immediate suppliers, and investigators often spend valuable time piecing together records from multiple sources.

Technology alone won’t prevent food fraud. But stronger supplier verification, better-connected information, and the ability to share data across trading partners can help companies recognize vulnerabilities and respond more effectively when prevention fails.

The real opportunity is to take what we’ve learned from past incidents and put those lessons into practice. That means looking beyond regulatory requirements and asking whether our systems, processes, and supplier relationships are giving us the visibility needed to identify risks before they become another food safety crisis.

Investigation background draws on the authors’ direct experience with the FDA response, supplemented by Weed et al., “International Investigation of Lead and Chromium Contamination in Imported Apple Puree,” Journal of Environmental Health, Vol. 89, No. 1 (July/August 2026) (DOI link); FDA’s warning letter to Austrofood S.A.S., MARCS-CMS 679052, August 9, 2024; reporting by Will Fitzgibbon for The Examination, in partnership with The New York Times and El Universo; the Food Authenticity Network’s “2024 Global Food Fraud Report”;