Fake peptide COA: 15 signs a certificate is forged, borrowed or too weak to trust

How to spot a fake peptide COA

The strongest test is simple: look the report up on the issuing lab’s own website. A forged or edited COA fails that check, whatever it looks like. The 15 signs below tell you when to look harder, and they also catch genuine reports that prove less than they seem to.

The signs fall into three groups:

• Forged or edited: the document was made or changed by someone other than the lab.
• Borrowed or reused: the report is real, but it belongs to another batch, product or seller.
• Real but weak: the report is genuine and current, but its evidence is too thin to rely on.

Rating sites see all three. Disclosed Labs reports that it checked 2,252 COAs against 8 lab portals, and the labs confirmed 2,092 of them (92.9%). The rest could not be confirmed at the source. PeptideBenchmark’s anomaly review lists 4,218 signals across 17 rule groups, from reused reports to date conflicts. It adds that “signals are not allegations”, which is the right way to read every sign here: a reason to check, not proof.

Signs a COA was forged or edited

1. The lab has no record of it. Type the lab’s address yourself, open its lookup and enter the report number and key. No record, or a record with different results, ends the question. Our step-by-step guide on how to verify a peptide COA covers labs with and without a lookup.

2. The QR code or link is missing, cropped or points elsewhere. The verification block is the part that would expose an edit, so its absence matters. A QR code that opens a domain other than the lab’s own is a strong warning.

3. It exists only as a screenshot or a re-typed document. A screenshot cannot be checked against a file fingerprint, and a re-typed table proves nothing. Some labs do issue image files, so an image alone is not proof of forgery. It does mean you must confirm it at the lab.

4. The layout does not match the lab’s other reports. Compare fonts, logo position, field order and report-number format with a report you opened on the lab’s site. A different number format or a field the lab never prints suggests an edited template.

5. The numbers repeat exactly across products or batches. Two different batches rarely give identical purity and mg to the last decimal. Identical results on different products point to a copied file.

Signs a COA was borrowed or reused

6. The lot does not match your vial. Lot numbers are usually supplied by the client, so the lab prints what the seller told it. If the report’s lot differs from the lot on your vial, the report describes another batch. A lot field that holds a date, a cap colour or nothing at all makes the match impossible.

7. One report covers several products or strengths. A lot is one batch of one compound. Disclosed Labs counts a lot number that spans two different peptides at the same seller as a forgery signal, and calls it “pharmaceutically impossible”.

8. The same report appears under different sellers. Disclosed flags a lot number seen under two or more sellers, and notes it can mean a reseller chain or a copied COA. PeptideBenchmark flags identical files across sellers. Our guide on reused COAs explains how this happens and how to check it.

9. The client on the lab’s record is someone else. A lookup that shows the ordering client lets you see who the report was made for. A report ordered by one seller and shown by another is borrowed, even if every number is real. A report under a seller’s own brand, with the lab hidden, is the related problem of white-label COAs.

Signs a COA is real but weak

These six signs come from what international standards ask of a report: ISO/IEC 17025 clause 7.8, the WHO model certificate of analysis and the ICH guidelines. HK Analytical’s September 2026 review of public COAs from 25 labs and one rating site’s certificate wrapper found each gap often.

10. Identity from retention time alone. ICH Q6A states that identification “solely by a single chromatographic retention time” is “not regarded as being specific”. Similar peptides can leave the column at nearly the same time. A mass match by LC-MS shows which molecule is there. In our review, 12 of 26 showed a mass spectrum, and only 3 printed expected and observed mass side by side with an error value.

11. Purity with many decimals and no evidence. A purity printed to three decimals means little without the chromatogram and peak table behind it. Only 4 of the 26 printed a proper peak table, and none printed its integration settings. Very high, very precise purity is covered in our guide on why 99.9% can be a warning sign.

12. mg with no basis and no reference standard. An mg figure can mean peptide only, peptide plus salt, or total powder. Of the 26, 21 printed mg per vial, but only 1 clearly stated what the mg meant.

13. “Pass” with no specification or rule. A pass needs a stated limit and a decision rule that says how uncertainty is handled, as ILAC G8 describes. None of the 26 stated a decision rule.

14. “Sterility” that is not a sterility test. USP <71> incubates for at least 14 days. A PCR screen, a microbial count or a two-day culture is a different test. None of the 26 showed a documented 14-day USP <71> test with the number of units.

15. Accreditation marks with no scope. ILAC P8 says a report must not imply accreditation for tests outside a lab’s scope. Check the certificate number and the scope on the accreditation body’s register. We do not hold ISO/IEC 17025 accreditation.

The 15 signs at a glance

#	Sign	What it suggests	What to do
1	No record at the lab	Forged	Do not rely on it
2	QR or link missing or redirected	Forged or edited	Type the lab’s address yourself
3	Screenshot or re-typed only	Unverifiable	Ask for the original file
4	Layout unlike the lab’s own	Edited template	Compare with a lab-hosted report
5	Identical numbers across batches	Copied file	Ask for each batch’s report
6	Lot does not match your vial	Other batch	Ask for this batch’s report
7	One report, several products	Reused	Treat as unverified
8	Same report under several sellers	Reused	Check the client on the lab record
9	Different client on the lab record	Borrowed	Ask the seller to explain
10	Identity by retention time only	Weak identity	Look for an LC-MS mass match
11	Precise purity, no chromatogram	Weak purity	Ask for raw data
12	mg with no basis	Unclear amount	Ask for basis and standard
13	Pass with no specification	Unclear verdict	Read the numbers, not the badge
14	Short “sterility” test	Misnamed test	Look for USP <71>, 14 days
15	Accreditation logo, no scope	Possible over-claim	Check the register

What to do when a COA fails a check

Contact the lab named on the COA, using the address on the lab’s own website. Send the file and ask it to confirm or deny the record. Do not rely on the seller’s explanation alone.

If the lab confirms the report but it belongs to another batch, ask the seller for the report that matches your lot. If no matching report exists, the only way to know what is in your vial is to test it. Our guide on vendor COAs versus your own test covers how to make that result count.

How HK Analytical reports resist forgery

Each HK Analytical report has a private link made of a report ID and an access key, checked at hkanalytical.com/verify. The report page shows the status, the results and the PDF fingerprint, and your browser can fingerprint a PDF you were given without uploading it. Each report is a signed record (an Ed25519 signature over the canonical record), so a changed number breaks the signature.

The report carries our own photo of the vial as received, and it states how the client is related to HK Analytical, inside the signed record. Identity is by LC-MS mass, and every number comes with its raw data. See all of it on the example report, and use how to read a COA for any lab’s report.