It's okay. You are just asking questions, and some people tend to want to protect themselves insofar as their adherence to the rules of the forum, one of which is to avoid knowingly making defamatory comments, etc. Evidently, you were not knowingly hurting anyone's reputation nor were you slinging insults or coming out and accusing someone of something. I am not an administrator on this board, but from my perspective, it seems as though your questions were thoughtful and straightforward (as well as benign).
It is very possible that the boyfriend obtained the "tools of his trade" the best way he knows how: by deception, observation and theft.
Since the incidents occurred in Pa. - I am assuming in the eastern part of the state, the "hard copy" is not usually required in order for Schedule IIIs to be dispensed. Schedule IIIs include drugs like hydrocodone. The last time I checked, it was permissible for this class of drugs to be phoned in to a pharmacy . I believe - but I could be wrong - that some doctors do not, as a matter of course, phone in any scripts for narcotics unless it is a dire emergency. I would also suggest that that any pharmacy has the option of filling or not filling a phoned in prescription if there is sufficient reason to doubt its authenticity.
From what you have related, it seems as though the BF hit the jackpot the first couple of times anyway. Or did he?? It's just as likely that at least a few of the pharmacy employees were suspicious, and were simply keeping their eyes on him for a while, waiting for him to fall into his own net, which, it appears, is exactly what happened.
The bigger, chain pharmacies in Pa. have been electronically linked for a while now - not sure just how long, though - and, to a doctor shopper or fraudulent prescription user, the implications of this are enormous. For one thing, having RiteAid and CVS, for example, on the same linked network enables the pharmacist at RiteAid to see what "Mr. Smith" picked up at the pharmacy over at CVS. There's no reason that a pharmacist can't go down the line and check what Mr. Smith has over at any one of the big chain pharms. Nowadays, this is one way many doctor shoppers get caught.
The ostensibly slow progression of the case might only appear that way to those on the outside. As someone else also suggested in his/her post, it is not out of the question for the person who has been charged with a drug crime to be utilized by law enforcement as a means of bringing in other players related to the drug "business." The would-be defendant (in this case, the BF of your niece) is usually - if not always - sworn to absolute secrecy in such ongoing investigations.
Of course, this still doesn't answer your other question that wonders how the BF was able to obtain these Schedule III substances without benefit of a physician's DEA no., as well as the BF's success in signing for the drugs using another person's name and insurance card. Your other query concerned the apparent ease with which he procured the prescriptions without being required to show I.D.
I am going to offer sheer speculation re: the above by suggesting several possibilities:
The BF possibly gave a very convincing story that he was picking up the prescriptions for his mother who was home, sick in bed, unable to fetch her own medication. Depending on the BF's demeanor and overall appearance, there is a chance that he managed to slip through the crevices or, at least with respect to some of the pharmacies, that he did not really slip through at all - just into a waiting net.
If he's been watching the pharmacies - or if he's been informed by someone in his network of "interested parties" - then he probably knew when the pharmacies were extremely busy, too busy, perhaps, to scrutinize him too extensively.
Are you absolutely certain the BF did not give a DEA number when he phoned in the prescription? Even without one, if he knew even one employee in one drugstore who could obtain that piece of info. for him, then that would be one less hurdle for him to leap over. I do not have an answer as to how he was able to get what he wanted without the required D.E.A. no. Some prescription bottles will bear the DEA no. of the prescribing doctor. Are you sure he didn't manage to lift this very valuable piece of information from one of the prescription bottles in your sister's medicine cabinet?
From what I have experienced - and I reside in Pa. - not ALL Pa. pharmacies ask for I.D. when picking up Schedule III medications. I have never been asked for I.D. when picking up a Sch. III. I suppose that depends on certain factors, not the least of which is the frequency with which fraudulent/criminal activity takes place in a particular pharmacy.
In a very busy pharmacy, I imagine it is not always possible for pharmacists, techs, and cashiers to successfully "police" at all times the hundreds of unscrupulous customers retrieving prescriptions from that pharmacy. Hence, there is always that chance that your niece's BF skipped around town and visited multiple pharmacies, spreading himself thin so as not to arouse suspicions in any one store. Perhaps he was "successful" - at least in some of those instances.
An additional consideration is that the pharmacy employees' suspicions were aroused by the BF and that some of them did, at some point, contact the doctor whose name was being used as the prescriber for the medication. Even so, one cannot discount the possibility that the doctor was either not in his office at the time of the call, or WAS in his office, and for some reason was not in favor of pursuing a full-scale prosecution of the BF.
I am not an attorney and am just offering various scenarios. By no means do I know the individuals, law enforcement, laws, jurisdictional procedure, or the pharmacies and/or employees involved in this case. However, the situation as you presented it is by no means unique, and having heard of, and read about similar situations, I felt compelled to offer you my layperson's perspective. I hope it helped in some way.