Reused COAs: how one peptide test report ends up on many products

What a reused COA is

A reused COA is a real lab report shown for something the lab did not test. The lab issued it, so it passes a lookup on the lab’s website. The problem is what it is attached to: a later batch, another strength, another product or another seller.

That makes reuse harder to spot than forgery. A forged COA fails at the lab. A reused COA only fails when you compare the lab’s record with the product in front of you. This guide shows how reuse happens, what the public data says about it, and how to catch it in a few checks.

How one report ends up on many products

Reuse needs no forger. It can come from ordinary shortcuts in how sellers publish reports.

Route	How it happens	What you see
Old batch, new stock	The seller keeps showing the report from its first batch	A report date long before the batch was made; a lot that differs from your vial
One report, several strengths	A 5 mg result is shown on the 10 mg and 15 mg listings	Label claim on the report differs from the vial
One report, several products	The same file appears for different peptides	The same report number on unrelated listings
Shared by resellers	Several shops sell from one supplier and post the same report	One lot number under several seller names
Copies under other names	The client pays the lab for extra copies under other company names	The same results, different company names
Borrowed	A seller shows a report another client ordered	A different client on the lab’s record

The fifth route is a lab product, not a seller shortcut. In HK Analytical’s September 2026 research, five labs offered some way to issue one result under more than one company name. Each copy can be genuine and still describe one vial from one client. Our guide on white-label COAs covers that practice.

What the public data shows

Two rating sites count reuse at scale. Their numbers are the main public data on how often it happens.

PeptideBenchmark’s registry

PeptideBenchmark collects public COAs from seller pages and links each to the lab that issued it. Its registry shows, for each lab, a count of reused records. On 4 October 2026 it listed 27 named laboratory entries and 13,468 attributable certificate records.

Adding the per-lab counts on that page gives these totals:

Measure (4 October 2026)	Value
Lab entries in the registry	27
Certificate records attributed to them	13,468
Reused records, all labs	372
Share of records flagged as reused	about 2.8%
Lab entries with at least one reused record	13
Lab entries with none	14
Largest count for a single lab	188

Read these numbers with care. Labs with more reports and more seller clients have more chances to be reused, so a higher count often reflects volume. A reused record describes how a document was used. It does not say the lab did anything wrong, and we do not name labs with their counts for that reason.

Anomaly signals

PeptideBenchmark also runs an anomaly review over 17,610 source-linked public COA records. On 4 October 2026 it listed 4,218 signals across 17 rule groups, with 4,210 still unresolved and none confirmed. It states plainly: “Signals are not allegations.”

The rule groups show the patterns that reuse leaves behind. Several bear directly on it:

• report reused across compounds;
• batch reused across compounds;
• identical file across vendors;
• identical file on multiple products;
• lot shared across vendors;
• one report number with several file fingerprints;
• provider link reused in a different context;
• date chronology conflict and future testing date.

A report number with several file fingerprints is worth a note. A file fingerprint (hash) changes when any byte changes. One report number with several fingerprints means several different files claim to be the same report, so at least one was edited, re-saved or rebuilt.

Disclosed Labs’ lot rules

Disclosed Labs gives 15% of each seller’s grade to forgery signals. Three of the signals in its methodology bear on reuse:

• Cross-vendor lot collisions: its flag fires “whenever the same lot number appears under two or more distinct vendors”. It notes this can mean a reseller chain or a copied COA.
• Cross-peptide lot collisions: the same lot number on two or more different peptides at one seller, which it calls “pharmaceutically impossible since a lot is one batch of one compound”.
• Perceptual-hash collisions: images that match by perceptual hash, a fingerprint that stays the same after resizing or re-compression.

Disclosed also checks COAs against lab portals. In its sweep of 23 May 2026 it reports 2,252 COAs checked across 8 portals, with 2,092 confirmed by the labs (92.9%). A lab confirming a report is the first step. Reuse checks start after it.

Why a reused COA misleads even when the test was real

The lab measured one sample. ISO/IEC 17025 asks labs to state that results apply to the sample as received when the lab did not take the sample (clause 7.8.2.2). A report reused for another batch carries that sample’s numbers onto vials the lab never saw.

Those vials can differ in every result that matters. A new synthesis batch can have a different impurity profile. A new fill run can put a different mg in each vial. A swapped or mislabelled product can fail identity outright. None of that shows on a report from another batch.

Why lot numbers make reuse easy

The lot number is the field that ties a report to a batch, and it is usually supplied by the client. The lab prints what the client wrote on the form. ISO/IEC 17025 asks labs to mark client-supplied information as such, because the lab cannot vouch for it (clause 7.8.2.2).

In HK Analytical’s September 2026 review of public COAs from 25 labs and one rating site’s certificate wrapper, only 10 of 26 reliably printed a real seller lot. Others printed a date, a cap colour, the lab’s own code, or nothing. Without a real lot, a buyer cannot match a report to a vial, and one report can sit on any batch.

A lab photo helps here. The WHO model certificate of analysis notes that a certificate may include photographs of the packaging or product tested. A photo taken on receipt shows the lot printed on the vial, the cap and the label, whatever the client typed on the form. In the same review, only 8 of 26 showed the lab’s own sample ID in the vial photo, which is what ties the photo to the report.

How to spot a reused COA: eight checks

#	Check	How to do it	Reuse looks like
1	Lab record exists	Type the lab’s web address yourself, enter the report number and key	A record exists, so continue
2	Lot matches	Compare the lot on the lab’s record with your vial	A different lot, or no lot
3	Strength matches	Compare the label claim on the report with your vial	A 5 mg report on a 10 mg vial
4	Product matches	Compare the peptide name	A report for another compound
5	Client matches	Read the client name on the lab’s record	Another seller’s name
6	Date fits	Compare the report date with the batch	A report older than the batch
7	Photo matches	Compare cap, label and fill with your vial	A different cap colour or label
8	Report is unique	Search the report number on the web and on rating sites	The same number on other listings

Checks 1 and 2 are the quickest to run. Our guide on how to verify a peptide COA explains the lookup in detail, and the 15 signs of a fake or weak COA covers forgery as well as reuse.

If a report fails any check, ask the seller for the report that matches your lot. If none exists, a test of your own vial is the only direct evidence. See vendor COAs versus your own test.

What makes reuse harder

Some report designs make reuse easy to see. Each of these is a choice a lab can make:

• a lab photo of the vial as received, with the printed lot and the lab’s own label in the frame;
• the client’s identity, or at least its category, on the lab’s record;
• a long random access key, so reports cannot be listed or guessed;
• a status on the lookup page (valid, replaced, withdrawn), so an old report shows its age;
• a file fingerprint, so an edited copy no longer matches.

Rating sites already reward these features. PeptideBenchmark records whether each lab’s lookup links still respond. Peptigrity marks each certificate as lab-verified, unverified, from a lab with no portal, or not found.

What HK Analytical does

Each HK Analytical report carries our own photo of the vial as received. It states how the client is related to HK Analytical, and that statement sits inside the signed record (an Ed25519 signature over the canonical record), so it cannot be cropped or edited out without breaking the signature (see signed COAs). Every report has a private link made of a report ID and an access key, checked at hkanalytical.com/verify. The report page shows the sample, the results, the status and every version.

Reports are never edited after issue. A change makes a new version, and the old one is marked superseded, so an outdated copy shows its status. Sellers who need batch reports can see our vendor testing, and the example report shows every field. Use how to read a COA on any lab’s report. We do not hold ISO/IEC 17025 accreditation.