How Vendors Fake a COA: Chromatogram and Document Forensics on a Fake Peptide COA

A fake peptide COA is almost never a crude forgery drawn from nothing - it is usually a real laboratory report with the wrong numbers typed into it, and that is why it survives a casual glance and fails a structured one. The economics push forgers in one direction: editing an existing PDF costs minutes, while faking a plausible analytical run costs expertise nobody in this market has. So the tells are structural, not cosmetic. A baseline with no detector noise on it. A single implausibly symmetrical spike with no solvent front. An impurity table whose area percentages do not sum. Identical retention times on two chemically different peptides. One genuine report recycled across a year of lot numbers. Letterhead lifted from a lab that never tested the material. Purity figures that land on a flawless value for every product in a catalogue, which real synthesis never does. And underneath all of it sits a second scam entirely - the clone storefront, where every certificate is genuine because it was stolen from the vendor being impersonated. All of these collapse against one check, and only one: an accession number that resolves, on the issuing laboratory’s own public portal, to a live record matching the compound, lot, purity and methods on the paper.

Published 2026 - For research use only (RUO). Nothing here is medical advice, a dosing protocol, or a human-use recommendation.

In a hurry? Jump to how Pepora scores on the checklist →

---

The forger’s toolkit: what actually gets faked, in order of effort

Understanding a fake is easier if you rank the techniques by how much work they take. Almost every fraudulent certificate in circulation sits in the first three tiers, because the higher tiers are expensive and the lower tiers already work on most buyers.

1. Retype a number. The cheapest attack. Take a genuine report, change 96.4% to 99.4%, ship it. Nothing else on the page changes, which is the weakness - the chromatogram and integration table still describe the original material.
2. Swap the identity fields. Change the compound name, the lot number, and the date, keep everything else. This is what produces the most diagnostic failure in the whole market: two different peptides carrying the same chromatogram and the same retention time.
3. Recycle one real report. Publish a single genuine COA and attach it to every subsequent batch. Analytically this is impossible - separate synthesis runs do not reproduce identical peak areas - but it requires the buyer to compare across lots to notice.
4. Reuse the letterhead. Put a real laboratory’s masthead on a document that laboratory never issued. FDA has documented the licensed-industry version of this: one manufacturer generated certificates of analysis by copying and pasting analytical results from original API manufacturers onto its own letterhead, omitting the originating manufacturers and the labs that actually did the testing. FDA used near-identical language in warning letters to Lumis Global Pharmaceuticals (March 2, 2017) and Suzhou Pharmaceutical Technology (January 6, 2017), each describing COAs assembled by copying the original API manufacturer’s results and substituting the recipient’s own letterhead while omitting the originating manufacturer and testing laboratory.
5. Fabricate the record trail. In March 2025 FDA issued a warning letter to a Thailand-based OTC drug manufacturer supplying the US market, after investigators documented multiple examples of fabricated laboratory records, with the firm’s own laboratory manager stating that laboratory investigations recorded as performed had not been performed.
6. Manipulate the raw data at source. The most sophisticated tier, and the one with the most famous precedent. In the 2005 Able Laboratories case, FDA inspectors found cutting and pasting of chromatograms, vial substitution, altered sample weights and changed processing methods; one atenolol dissolution result reported at 102.8% had an underlying value of 30.9% against a specification of not less than 85%. Reporting on the case notes that the firm’s licences were withdrawn, thousands of batches were recalled, the company closed, and individuals were later prosecuted.
7. Skip the document entirely and clone the seller. Covered in its own section below.

Tiers 1 through 3 are what a grey-market buyer will realistically meet. They are also the easiest to catch, because they leave arithmetic and physics behind them.

Chromatogram forensics: read the trace, not the headline number

The purity percentage is the part of a COA a forger edits first and the part that carries the least information. The chromatogram is harder to fake convincingly, because a chromatographic trace is a physical record with properties that a person drawing a picture does not think about.

Peptides are typically analysed by reversed-phase HPLC with UV detection in the 214-220 nm region, where the peptide bond itself absorbs, and purity is reported as the target peak’s area as a percentage of total integrated peak area. Identity is confirmed separately by mass spectrometry. Those two facts generate most of the checks below.

What you see on the trace	Why it is implausible	What a genuine run shows
A dead-flat baseline with no noise at all	Detector noise is intrinsic. ICH Q2(R2) defines the detection and quantitation limits by signal-to-noise ratios of about 3:1 and 10:1 - concepts that only exist because a real baseline has measurable noise	A visibly textured baseline, often with slow drift across a gradient run
One lone peak, no solvent front, no injection artifact	Every injection puts unretained material through the column at or near the void volume	A solvent front early in the run, then the analyte peak, usually plus small impurity peaks
A perfectly symmetrical peak, tailing factor exactly 1.00	Real peptide peaks tail slightly on reversed-phase columns. USP General Chapter 621 (Chromatography) states that the symmetry factor of the peak used for quantification is 0.8-1.8 precisely because 1.00 is an ideal, not an observation	A peak with mild asymmetry, a stated tailing or symmetry factor somewhere inside that window
Impurity peaks are drawn, but purity is stated as 100.00%	If secondary peaks exist and are integrated, their area is not zero, so the main peak cannot be the whole area	A main-peak area percentage plus a listed remainder, summing to 100
The same retention time on two different compounds	Different sequences have different hydrophobicity, so under one gradient they elute at different times. Co-elution is possible under a generic gradient, but identical retention times across chemically distinct peptides are strong evidence that one document was copied	Retention times that differ between compounds and shift slightly between runs
No column, gradient, flow rate, wavelength or run time stated	These parameters are the method. Without them the number is unreproducible by anyone	A method block naming column chemistry and dimensions, mobile phases, gradient, flow, detection wavelength and injection volume
Purity quoted to four decimals with no integration table	Precision is being used as a costume. A stated 99.9987% carries no more evidence than 99% if the areas behind it are not shown	A purity value plus the peak table it was calculated from
A single average molecular weight, no charge states or spectrum	Electrospray mass spectrometry of a peptide produces multiply charged ions and an isotope envelope, not one number	Observed m/z values you can check arithmetically

That last row is worth doing by hand once, because it is the check almost nobody runs. BPC-157 free base has a molecular weight of about 1419.5 g/mol. If a report claims electrospray confirmation, the doubly protonated ion should appear near m/z 710.8 and the triply protonated ion near m/z 474.2 - add the proton masses and divide by the charge. A “mass spec confirmed” line with no spectrum, no m/z values and nothing to divide is decoration. Our peptide molecular weight reference lists the formulas and weights for the common research peptides so you can run that arithmetic yourself, and how to read a peptide COA walks through what each block of a genuine report is doing.

One more numerical tell that requires no chromatography at all: flawlessness across a catalogue. Real synthesis varies. A Ghent University group tested 98 synthetic quorum-sensing peptides that had all been supplied with certificates claiming at least 95% purity; on independent analysis only 44% actually met that specification, none of the cyclic peptides exceeded 90%, and one sample’s main peak turned out to be a different structure altogether from the one ordered. That is what real supplier variation looks like under a microscope. A vendor whose every product returns a pristine, similar, high-nines figure is either extraordinarily lucky or is not showing you measurements.

What a real synthesis leaves behind is also well characterised rather than mysterious: a standard review of related impurities in peptide medicines catalogues the deletion, insertion, truncation, oxidation and racemisation products that solid-phase synthesis generates, and those are precisely the small secondary peaks a genuine chromatogram shows. Their absence is not purity, it is an omission. The wider baseline for unregulated online markets is not encouraging either - an analysis of 84 cannabidiol products sold by 31 online vendors found only 30.95% were labelled accurately within 10% of the stated concentration. Different compound class, same structural problem: a label claim nobody independently checks.

Document forensics: lot numbers, letterhead, dates and file internals

Once the trace has been examined, the paperwork around it carries its own fingerprints.

Lot logic. Lot or batch numbers are normally sequential or date-encoded, and each lot is a separate synthesis with its own analytical result. Two failures are diagnostic. First, the same lot number appearing on products bought months apart - either nothing new was made, or one COA is being recycled. Second, lot numbers on the vial, the listing, and the certificate that do not agree with each other. A certificate that does not name the exact lot in your hand does not describe the material in your hand, no matter which lab issued it.

Date logic. Compare the test date on the report against the manufacture date on the lot and the date the listing appeared. A test date preceding the batch it certifies is a straightforward impossibility. A whole catalogue of certificates sharing a single test date suggests one document was templated rather than a set of samples submitted. A modification date long after the analysis is a question, not a verdict.

Letterhead and signature reuse. A masthead is an image file. The same signature block appearing on certificates attributed to two different laboratories is conclusive - one of them did not sign it. FDA’s November 2024 warning letter to a New Delhi medicated-patch manufacturer described exactly this mechanic inside a licensed facility: a quality-control analyst with the ability to manipulate results, dates and images of in-house and vendor stamp approvals on component certificates of analysis, including the means to duplicate a stamp approval across multiple COAs, while receiving supplier certificates as editable Word files over a personal messaging app. If that is possible inside an inspected plant, assume it is trivial outside one.

File internals. Open the document properties and look at the creator and producer applications and the creation date. Then check whether the numbers are selectable text or a flattened image, and whether the region around a purity figure looks recompressed relative to the rest of the page - a hint that one value was pasted over another. Be honest about the limits here: many legitimate labs assemble reports in ordinary office software, metadata is easily stripped or rewritten, and this is directional evidence at best. It is a reason to look harder, never a proof on its own.

The named-lab test. A certificate with no laboratory named, or a lab whose name returns no independent web presence, no address and no public results portal, is self-certification wearing a costume. The broader risk here is documented at regulatory scale: FDA has publicly acted against third-party testing firms over data quality and integrity failures, and has warned that medical-device premarket submissions have arrived containing test data that FDA found to be falsified or otherwise invalid, including results copied from another study. “A third party tested it” is not a magic phrase - which third party, and can you reach their records without the seller’s help?

For the vendor-level version of these signals, our peptide vendor red flags guide covers the operational tells that sit around the paperwork.

The clone storefront: when the COA is genuine and the seller is not

Every check above assumes the fraud is in the document. A pattern worth naming separately inverts that. The operator does not forge anything: they copy an established vendor’s entire storefront - branding, photography, product copy, and the vendor’s real, fully verifiable COA library - onto a lookalike domain or a lookalike social account. Every certificate on the clone is authentic. It was simply lifted from someone else, and it describes material the clone never had.

This is being reported by vendors themselves. In a public notice, the European supplier Particle Peptides warned of unauthorised use of its name, logo and visual identity across a fraudulent website and impersonating social accounts, listing handles built on character substitution - one example replaced the letter i with a lowercase l, which is visually near-identical in most sans-serif fonts. We are reporting the company’s own published claim rather than an independent finding, but the technique is generic and worth internalising regardless of who it happened to.

The regulated-medicine world has already seen the endgame of this logic. In its June 2024 alert on falsified semaglutide products (Medical Product Alert N°2/2024, summarised in WHO’s 20 June 2024 statement), WHO reported falsified batches detected inside regulated supply chains in Brazil and the United Kingdom in October 2023 and the United States in December 2023 - and in one case the batch number printed on the falsified product was a genuine batch number. A real identifier on a fake item is the whole problem in one sentence.

Three practical consequences follow:

• Type the domain, do not click it. Reach the vendor by typing the address, not through a social bio, a forum link, a search advertisement, or a QR code. Homograph and character-substitution domains are built to survive a glance.
• A verified COA authenticates a lot, not a seller. The accession lookup proves the laboratory tested that material for whoever submitted it. It does not prove the site you are on is the party that submitted it. Domain age, a consistent contact address, and continuity of the same business identity across time carry that second question.
• Check for a matched pair. The strongest position is a certificate whose lot number matches the vial and whose accession resolves on the lab’s portal and which was published on a domain you reached independently. Any one of the three alone is weaker than people assume.

What this means for vetting a vendor

Strip the forensics down and the checkable criteria are short. None of these require equipment; all of them can be done before payment.

Check	Pass	Fail
Named third-party lab	Lab is named, has an independent public presence and a results portal	No lab named, or “third-party tested” with no name
Accession or report number	Printed on the certificate and resolves on the lab’s own domain	Absent, or only resolves via a link the vendor controls
Lot match	Vial lot = listing lot = certificate lot	Any mismatch, or a certificate with no lot at all
Chromatogram present	Trace with baseline noise, solvent front, method parameters and an integration table	Purity figure alone, or a drawn-looking single spike
Identity evidence	Mass-spectrometry data with observed m/z values you can check	“MS confirmed” with no spectrum or numbers
Cross-batch variation	Different lots show different retention times, areas and purity values	Identical analytical data across lots or across products
Catalogue honesty	Vendor states plainly which SKUs have third-party reports and which do not	Implies blanket coverage; certificates only for hero products
Route to the site	Domain typed directly, stable business identity over time	Reached via a social bio, ad, or DM; near-miss spelling

Two habits matter more than the rest. First, do the lookup before you pay - a verification you run after the vial arrives is a receipt, not a decision. Second, accept that partial coverage is the norm and treat honesty about it as a positive signal, not a defect. Our COA lookup walkthrough covers the mechanics step by step, and how to vet a US peptide vendor covers the jurisdiction and shipping side. If you are comparing on price as well as paperwork, the cost per mg calculator normalises listings that use different vial sizes, and the vendor transparency scorecard turns the table above into a score you can apply to any seller.

How Pepora scores

Applied to Pepora (peporalabs.com), the checkable facts are these. Pepora ships from the US and publishes third-party certificates from Freedom Diagnostics, a US laboratory that runs HPLC with UV detection for purity and mass spectrometry for identity, and that makes results searchable by search code at FreedomDiagnosticsTesting.com. Four SKUs currently carry an accession-verifiable Freedom Diagnostics report:

Product	Stated purity	Accession
GHK-Cu	99.981%	Pepo2603130126
Tesamorelin	99.348%	Pepo2603130125
TB-500 / Thymosin Beta-4	99.699%	Pepo2603130123
GLP-3 RT	99.67%	Pepo2603130122

What that satisfies from the checklist above: a named third-party laboratory, a resolvable search code on that laboratory’s own domain, and analytical methods stated rather than implied.

The four purity figures are 99.348, 99.67, 99.699 and 99.981, which are four distinct measurements rather than one number repeated.

The honest limit, stated plainly: that is four SKUs, not the catalogue. Pepora also lists BPC-157, Epitalon, Thymosin Alpha-1, ARA-290 and the KLOW, Glow and Wolverine blends, and we are not claiming an accession-verifiable Freedom Diagnostics report for those. Where no such report is published, apply exactly the same scepticism you would apply to any other vendor - and do the lookup yourself on the four that do have one rather than taking this page’s word for the numbers. That is the entire point of the article.

The disclosed pick

FAQ

Can a peptide COA actually be faked? Yes, and it rarely requires skill. Most fakes are not drawn from scratch - they are a genuine PDF from a real laboratory with the compound name, the lot number, and the purity figure edited, or a real report from one batch recycled across many batches. FDA enforcement records the same techniques inside licensed manufacturing: one 2024 warning letter to a New Delhi patch manufacturer described a quality-control analyst able to manipulate results, dates and images of vendor stamp approvals on certificates of analysis, and to duplicate a stamp approval across multiple COAs. Because the document is so cheap to alter, the document itself proves nothing. Only a lookup on the issuing lab’s own portal does.

How can you tell if a chromatogram on a COA is fake? Look at the baseline before you look at the peak. Every real detector produces noise, which is why ICH Q2(R2) lists signal-to-noise as one accepted approach to detection and quantitation limits, calling 3:1 acceptable for the detection limit and at least 10:1 for the quantitation limit - those ratios only mean something because noise exists. A trace with a perfectly flat, dead-clean baseline and one impossibly symmetrical spike has been drawn, not measured. Other tells: no solvent front or injection artifact, no axis units, no gradient or wavelength stated, an integration table whose area percentages do not sum, and the same retention time appearing on two chemically different peptides run on the same method.

What does a recycled COA look like? A recycled COA is a genuine report reused across lots it never covered. The signature is that analytical data which should drift does not: the same retention time to two decimals, the same peak areas, the same impurity profile, and the same purity value on batches synthesised weeks or months apart. Real batches vary, and the published literature shows they vary a lot - one Ghent University study of 98 synthetic peptides supplied with certificates claiming at least 95 percent purity found only 44 percent actually met that figure on independent testing. Identical numbers across lots are a copy, not a coincidence.

Does PDF metadata prove a COA is fake? No, but it is a useful hint. Opening the document properties shows the creator and producer application and the creation and modification dates. A laboratory report exported from a chromatography data system usually looks different from one produced in a graphics or presentation tool, and a modification date long after the stated test date is worth a question. Treat this as directional only: plenty of legitimate labs assemble reports in ordinary office software, and metadata can be stripped or rewritten as easily as the purity figure. Metadata never replaces an accession lookup on the lab’s own domain.

What is a clone storefront peptide scam? It is the inversion of a forged document. Instead of faking a lab report, the operator copies an established vendor’s entire site - branding, product photography, wording, and the vendor’s genuine COA library - onto a lookalike domain or social account. Every certificate on the clone is real, because it was lifted from the real vendor. One European supplier published a public notice in 2025 about exactly this, listing impersonating social accounts using character substitutions such as an l in place of an i, alongside a fraudulent website. The lesson is that COA authenticity and seller authenticity are two separate questions.

What is the single best defence against a fake peptide COA? An accession number that resolves on the laboratory’s own public portal, checked by typing the lab’s domain in yourself rather than following a link the seller gave you. That one step defeats edited PDFs, recycled reports, invented labs, and spoofed lookup pages simultaneously, because the forger has to control a system they do not own. Confirm that the live record shows the same compound, the same lot, the same purity, and the same methods as the PDF, and do it before you pay rather than after the vial arrives.

References

1. Verbeke F, Wynendaele E, Braet S, D’Hondt M, De Spiegeleer B. Quality evaluation of synthetic quorum sensing peptides used in R&D. Journal of Pharmaceutical Analysis. 2015;5(3):169-181. PMID 29403929. https://pubmed.ncbi.nlm.nih.gov/29403929/
2. D’Hondt M, Bracke N, Taevernier L, Gevaert B, Verbeke F, Wynendaele E, De Spiegeleer B. Related impurities in peptide medicines. Journal of Pharmaceutical and Biomedical Analysis. 2014;101:2-30. PMID 25044089. https://pubmed.ncbi.nlm.nih.gov/25044089/
3. Bonn-Miller MO, Loflin MJE, Thomas BF, Marcu JP, Hyke T, Vandrey R. Labeling Accuracy of Cannabidiol Extracts Sold Online. JAMA. 2017;318(17):1708-1709. PMID 29114823. https://pubmed.ncbi.nlm.nih.gov/29114823/ (84 products from 31 online vendors; 30.95% were labelled accurately within 10% of the stated concentration - an adjacent unregulated online market, cited here only as a baseline for online label accuracy.)
4. US Food and Drug Administration. Warning Letter, Unexo Lifesciences Private Limited (688163), 6 November 2024. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/unexo-lifesciences-private-limited-688163-11062024
5. US Food and Drug Administration. Warning Letter, International Laboratories Corp (698522), 10 March 2025. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/international-laboratories-corp-698522-03102025
6. US Food and Drug Administration. FDA Takes Action to Address Data Integrity Concerns with Two Chinese Third-Party Testing Firms. https://www.fda.gov/news-events/press-announcements/fda-takes-action-address-data-integrity-concerns-two-chinese-third-party-testing-firms
7. International Council for Harmonisation / FDA. Q2(R2) Validation of Analytical Procedures - Guidance for Industry. https://www.fda.gov/media/161201/download
8. United States Pharmacopeia. General Chapter 621, Chromatography (harmonised text, official 1 December 2022) - system suitability, including symmetry factor 0.8-1.8. https://www.usp.org/sites/default/files/usp/document/harmonization/gen-chapter/harmonization-november-2021-m99380.pdf
9. McDowall RD. The Able Laboratories Fraud Case: What Have We Learnt? LCGC. https://www.chromatographyonline.com/view/able-laboratories-fraud-case-what-have-we-learnt-
10. McDowall RD. The Role of Chromatography Data Systems in Fraud and Falsification. LCGC. https://www.chromatographyonline.com/view/role-chromatography-data-systems-fraud-and-falsification
11. World Health Organization. WHO issues warning on falsified medicines used for diabetes treatment and weight loss, 20 June 2024 (covering Medical Product Alert N°2/2024 on falsified semaglutide; batches detected in Brazil and the UK in October 2023 and the US in December 2023). https://www.who.int/news/item/20-06-2024-who-issues-warning-on-falsified-medicines-used-for-diabetes-treatment-and-weight-loss
12. Particle Peptides. Warning: protect yourself from scams (company’s own published impersonation notice; a vendor claim, not an independent finding). https://particlepeptides.com/en/blog/news/warning-protect-yourself-from-scams-shop-safely-at-particlepeptidescom
13. PubChem, BPC-157 (CID 9941957), C62H98N16O22, MW 1419.5. https://pubchem.ncbi.nlm.nih.gov/compound/9941957
14. US Food and Drug Administration. Warning Letter, Lumis Global Pharmaceuticals Private Limited, March 2, 2017. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters
15. US Food and Drug Administration. Warning Letter, Suzhou Pharmaceutical Technology Co., Ltd., January 6, 2017. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters
16. Freedom Diagnostics, Search Code lookup (four-character client prefix plus accession number). https://FreedomDiagnosticsTesting.com

coaindex is a Pepora affiliate (peporalabs.com) and earns a commission on purchases made with the code above. This is affiliate education, not journalism, and it ranks vendors on checkable, independently verifiable third-party-COA criteria. Research use only. Not for human or veterinary use, and nothing here is medical advice.