How peptide COAs get faked, and how to spot it

Why would anyone fake a certificate?

Because a certificate is often the only evidence a buyer sees, and a real analysis costs money and might not come back clean. The World Health Organization defines falsified medical products as those that "deliberately misrepresent their identity, composition or source", and notes that online sales through unauthorised sites have made it easier for them to reach consumers (WHO fact sheet: Substandard and falsified medical products). A falsified certificate applies the same deception to the paperwork.

This lesson describes techniques, not people. A document showing one of these signs may still be genuine; the right response is to check it, not to accuse anyone. Lesson 13 covered honest errors by real labs.

How are genuine PDFs edited?

The simplest fake starts with a real report. Someone opens it in an editor and changes a few characters: a purity of 96.1% becomes 99.1%, a batch code becomes the one on the current stock, a 5 mg label becomes 10 mg, or the compound name changes. The layout, logo and signature are genuine.

Visual clues sometimes give it away: a digit in a slightly different font, weight or spacing; text that does not line up with the rest of its row; a figure that is sharp while the surrounding text is blurred, or the reverse. Internal arithmetic is another clue. If a report gives peak areas and a purity figure, the purity should equal the main peak's share of the total, as lesson 3 showed. An edited purity rarely has matching edited peak areas.

Visual clues are unreliable in both directions: honest reports have formatting quirks, and careful edits leave none. The check that settles it is comparing the copy with the issuer's own record. If the lab's verification page shows 96.1% and your copy says 99.1%, the copy has been changed, whoever changed it.

How does a report fingerprint catch an edit?

Some issuers publish a cryptographic fingerprint, or hash, of each report file. A hash function such as SHA-256, specified in the US federal standard FIPS 180-4, turns a file into a short fixed-length digest. The standard states that such digests "are used to detect whether messages have been changed since the digests were generated" (NIST, FIPS 180-4). Change one character in the PDF and the fingerprint changes completely.

That makes the check mechanical. Compute the SHA-256 of the file you were given, using any free hashing tool, and compare it with the fingerprint the issuer publishes. A match means the file is byte-for-byte the one the issuer recorded. A mismatch means it is not, although it may simply be a re-saved copy, so a mismatch is a reason to compare the content with the issuer's record, not proof of tampering on its own.

How is one real report reused for many batches?

This needs no editing at all. A seller has one genuine report for one batch and shows it on every product page, every size and every restock. The document is real. It just describes a different vial from the one you are buying.

• The analysis date is older than the stock. A report from long before the product was listed, or before the batch on your vial could have existed.
• The same task number appears for several products or sizes. One analysis cannot cover a 5 mg and a 10 mg vial.
• The batch on the report does not match your vial, or the report names no batch at all, which is how one report can be made to fit anything.
• The same report appears on more than one seller's site. A report belongs to the client who submitted the sample.

Lesson 11 explains why a code match matters so much: without it, there is no thread from the report to your vial.

What can a screenshot hide?

A cropped image is not a forgery, but it lets the person cropping choose what you see. The parts most often cut are exactly the ones you need: the verification code, the batch, the analysis date, the scope of the test and any line that failed. An endotoxin-only report, cropped to show a passing result, can look like a full certificate. A purity figure without the identity line hides whether the molecule was ever checked.

An image cannot be fingerprinted against the issuer's file, or looked up if the code is cropped. Ask for the full PDF.

How are reports borrowed from someone else?

A genuine report, submitted by one client, is downloaded from a public listing and presented by another seller as their own. Sometimes the original client's name is cropped out; sometimes a new logo is pasted on. The analysis is real, but it was never of this seller's product.

Detection is again the issuer's record. Where it shows the client, sample description or submitter, compare it with the seller presenting it. Also compare the sample description: a report on a powder described as "white lyophilised powder, 10 mg vial, label: Brand X" cannot belong to a seller whose vials carry a different label.

How do invented labs and fake verify pages work?

The most complete fake invents the issuer. The certificate carries a plausible lab name, a logo, a signature and even a QR code. The QR code opens a convincing verification page on a domain that looks like a lab's, which confirms the document. Everything checks out, because whoever made the document also made the checking route.

The defence is to find the lab independently. Search for it by name. Look for an address, contact details and a history outside the seller's own pages. Check accreditation where it is claimed: accreditation is "the independent evaluation of conformity assessment bodies against recognised standards", testing laboratories are assessed against ISO/IEC 17025, and the ILAC site lets you look up recognised accreditation bodies (ILAC). Then type the lab's address into your browser yourself, rather than following the QR code or a link, and verify there.

For a report presented as Philippine, there is an extra check that is hard to fake. Section 40 of the Chemistry Profession Act provides that a document related to the practice of chemistry is not "considered as official or admissible for legal purposes unless such document is signed by a registered chemist and the chemist's registration number affixed thereto" (RA 10657, Lawphil). A registration can be checked by name or licence number on the Professional Regulation Commission's verification service (PRC LERIS). An invented chemist will not be there.

Which check catches which technique?

Two checks need no special skill and defeat most of the table: typing the issuer's address yourself, and matching the batch code. Lesson 15 turns them into a short routine. The peptide seller red flags guide covers warning signs on the seller's site more generally, and the COA checker walks through these questions for a document you already have.

What if a check fails?

Retype codes in case of a typo. Ask the seller for the full report and the issuer's contact. Ask the issuer directly whether the report exists. Until the issuer confirms it, treat the document as unverified, not as evidence, and not as proof of wrongdoing either. If the compound is one where a swap is a known concern, such as retatrutide, the cleanest answer is an identity result on your own vial by a method such as LC-MS.

Check your understanding