A Certificate of Analysis is easy to imitate and hard to verify, which is exactly why fabricated, recycled and vendor-issued COAs circulate freely. A polished-looking PDF proves nothing on its own. Here are nine concrete red flags that separate a document you can rely on from one designed only to reassure, along with how to check each.
None of these checks require a laboratory. They require reading the document as an auditor would: asking, for every claim, "what independent thing does this tie back to?" A genuine certificate, aligned with ISO/IEC 17025 and pharmacopeial (USP / WHO-referenced) practice, always has an answer.
1. No lot number, or a lot that does not match the label
A COA describes one specific batch. If there is no lot number, or the lot on the paper does not match the lot printed on the vial, the certificate cannot be tied to the material in your hand.
How to verify: read the lot on the physical label and confirm it appears, character for character, on the certificate.
2. The COA is issued by the vendor, not an independent lab
The most common weakness is a certificate produced by the seller itself. Self-issued results have an obvious conflict of interest.
How to verify: find the testing laboratory named on the document and confirm it is a separate entity from the vendor. Independent third-party labs such as Janoshik are widely used precisely because the tester is not the seller. If the "lab" and the shop are the same name, treat the result as a claim, not evidence.
3. No chromatogram image attached
A purity percentage without the HPLC chromatogram behind it is unverifiable. The chromatogram is where you confirm there is a single clean peak rather than a fabricated number.
How to verify: look for an embedded or attached chromatogram showing the main peak, its retention time, and the impurity peaks. No trace, no proof.
4. No LC-MS spectrum or mass confirmation
Purity tells you how much; only mass spectrometry tells you what. A certificate with a purity figure but no identity section leaves the molecule unconfirmed.
A pure peak is not necessarily the right peak. Without a mass result matching the stated sequence, even a flawless 99% purity figure could describe the wrong compound entirely. Identity and purity are separate proofs; a serious COA carries both.
How to verify: confirm the found mass matches the expected mass for the sequence at the top of the certificate.
5. A recycled COA reused across batches
Fabricators often reuse a single "good" certificate for many lots. The tell is that dates and values are identical across products or batches that should differ.
How to verify: if you have more than one certificate from a source, compare manufacture dates, retest dates, and purity values. Byte-for-byte identical results across supposedly different lots indicate a recycled document.
6. Missing or unverifiable lab accreditation
A credible lab references its competence, typically an ISO/IEC 17025 accreditation with a scope or certificate number that can be checked with the accrediting body.
How to verify: look for the accreditation reference on the report and, where possible, confirm the lab and its scope through the national accreditation registry. No number, or a number that leads nowhere, is a red flag.
7. Impossible or suspiciously rounded purity
Real analytical measurements carry uncertainty. A reported "100.0%" purity, or values that are always perfectly round, is chemically implausible for integrated chromatographic data.
How to verify: expect precise, non-round figures (99.1%, 98.7%) with a stated specification such as ≥98.0%. Perfection is a warning sign, not a reassurance.
8. Missing Karl Fischer or endotoxin fields
Fabricated certificates tend to include only the "impressive" numbers and drop the unglamorous ones. Genuine reports typically include water content by Karl Fischer and, where relevant, endotoxin by LAL.
How to verify: scan for these fields. Their absence on an otherwise "complete" certificate suggests it was assembled from a template rather than produced by a full analysis.
9. Editable metadata, mismatched fonts, or no analyst signature
Document-level tells often give away a forgery before the chemistry does. Watch for inconsistent fonts, values that look pasted over a template, PDF metadata showing edits in a graphics editor, and the absence of an analyst or quality-release signature.
How to verify: open the PDF's document properties to check the author, creator software, and modification history. A report "created" in an image editor, or one with no signature or release authority named, should not be trusted at face value.
The one habit that ties it all together
Every red flag above resolves to the same question: can this claim be traced to an independent source? A real certificate ties purity to a chromatogram, identity to a mass spectrum, the batch to a matching lot number, and the whole document to an accredited, named laboratory with a signature. When any of those links is missing, the certificate is decoration, not verification.