Signs of a falsified or inadequate COA: a practical document check

You do not spot a falsified COA by looking at it; you spot it by trying to verify it. Three checks are almost always enough: the internal consistency of the document, its match against the material in front of you, and confirmation from a source that is not the seller — the named laboratory and the public register in which its accreditation is claimed. Appearance is not a check. Logos, stamps and a scanned signature are the cheapest part of any document and the first part to be copied.

A second distinction is needed. A COA can be falsified — misstating who issued it, which lot it covers, or what was measured — or simply inadequate: genuine, but so thin that nobody can check it. The second is far more common, and for a laboratory record the two end in the same place: the material remains undocumented. So the question that works is not «is it fake?» but «which of its claims can I verify, and against what?»

Falsified and inadequate: two different failures

Directive 2011/62/EU defines a falsified medicinal product as one with a false representation of its identity, its source or its history — and history explicitly includes the records and documents relating to the distribution channels used ^[5]. In other words, falsifying the document is not an accessory to falsifying the material; it is the same act. The limit of the definition is that it covers medicines: research-use-only material is not a medicine and falls outside the Directive. The vocabulary stays useful; the legal protection that surrounds medicines does not exist here.

Inadequacy, by contrast, can be checked against a template. The World Health Organization publishes a model certificate of analysis for use in the trade of starting materials, with numbered fields and the explicit requirement that the certificate be an original, or that its authenticity be otherwise assured ^[1]. ICH Q7, for active pharmaceutical ingredients, requires every certificate to carry the name and address of the laboratory, the name of the material, the batch number, the tests with their acceptance limits and results, the date of issue, and the signature of authorised personnel; and where a certificate is reissued by an agent or repacker, the original manufacturer must be named ^[2]. A document lacking these does not fail on style — it fails functionally.

What a COA must contain to be checkable at all

The list below is not a wish list; it is the common ground between the WHO model and ICH Q7 ^[1][2]. Every missing field removes one way of checking, and some of them — report number, sample receipt date, name of the signatory — are precisely the fields a fabricated document avoids, because each one creates a point at which an outsider can ask a question.

• Identity of the issuer: full name and address of the laboratory that performed the tests, not just a logo ^[2].
• A unique report or certificate number — the key by which the laboratory can locate the file.
• Material name and batch number, identical to the one on the label.
• Date the sample was received, date of testing and date of issue: three dates in a logical order, not one.
• A description of the sample as received — form, quantity, condition of the packaging ^[1].
• For each test, on the same row: the method or a reference to it, the acceptance criterion, and the measured result ^[2].
• A stated conclusion covering all tests, rather than a single «PASS» stamp.
• Name, function and signature of the authorised person approving the report ^[1][2].
• Where the report is reissued by a supplier or repacker: the original manufacturer named, with a reference to the original certificate ^[2].

Check 1: internal consistency of the document

The first check needs neither a telephone nor a laboratory, only attention. A fabricated or partly edited document rarely fails in its fields; it fails in the relationships between them, because whoever assembled it changed two values and not the six that depend on them. Read it as though you intended to reproduce the test.

• Dates out of order: analysis before manufacture, issue before analysis, or a retest date that follows from neither.
• A batch number formatted differently from the same supplier's other documents, or the same number appearing on two different products.
• A result with no acceptance criterion beside it, or a «PASS» on a row where no limit is printed ^[2].
• A stated purity that does not reconcile arithmetically with the sum of impurities reported a few rows below.
• A measured mass that does not follow from the molecular formula printed on the same page.
• A method that does not match the quantity measured — «purity by mass spectrometry», for instance, where a mass match speaks to identity rather than to amount — or content with no reference standard cited.
• A chromatogram with no axes and no retention times, or an identical chromatogram appearing for two different peptides.
• Fonts, decimal marks or units that change style within one document: a sign that cells were copied from elsewhere.
• Contact details that do not belong to the named laboratory, such as a generic mail account instead of the organisation's own domain.

Behind every line of a COA there is supposed to be raw data. The WHO data integrity guideline sets out what that means: data must be attributable to a person, legible, contemporaneous with the work, original and accurate, with every change traceable ^[7]. As a buyer you will never see those records, but the question «which report number does this chromatogram belong to?» has an immediate answer when they exist and none when they do not.

Check 2: matching the document to the physical material

The second check is done with the vial in hand, and it fails more often than expected — usually not because anyone falsified anything, but because the COA of a different lot was sent, typically the last one on file. A flawless certificate for a different lot is evidence about somebody else's material.

• The batch number on the document appears verbatim on the vial label, with the same characters and the same spacing.
• The name and sequence in the document are identical to the label, not merely similar.
• The salt form declared on the COA is the salt form printed on the label.
• The description of the sample as received matches what you see: form, colour, condition of the lyophilised cake ^[1].
• The manufacturing date precedes the analysis date, and neither falls after shipping.
• The same COA, under the same report number, was not also supplied for an order you received months earlier.

Check 3: confirmation from a source that is not the seller

This is where the matter is settled, and it is the step almost always skipped. An independent testing laboratory keeps records of the reports it issues; ISO/IEC 17025:2017 sets requirements for technical competence, impartiality and consistent operation, and record-keeping is part of them ^[3]. A report number is therefore a question with an answer: contact the laboratory directly, give the report number, the date and the batch number, and ask whether the report came from them. No accusation is required. Two things are equally informative — the answer, and whether the supplier resents the question.

Accreditation is the second claim that can be checked without a laboratory. In Greece, the Hellenic Accreditation System (Ε.ΣΥ.Δ.) publishes a catalogue of accredited laboratories searchable by name and by accreditation certificate number ^[4]. Two points cost people regularly: accreditation is granted per method and per scope, never to a company as a whole, and the ILAC rules on the use of accreditation symbols require a body's claims about its status to correspond to its actual accredited scope ^[6]. The practical conclusion is simple: a logo without a certificate number and without a scope is not a claim you can check — it is a graphic.

What the digital file itself says

COAs circulate almost exclusively as PDFs, and the file carries information that is not on the page: document properties show the creating application, the creation date and the date of last modification. None of the signals below proves falsification on its own — plenty of legitimate laboratories scan, repackage or watermark their reports. They serve as a reason to ask for the original.

• A file creation date months later than the stated date of issue, or earlier than the date of analysis.
• A creating application that is an image or presentation editor where you would expect a laboratory information system or a word processor.
• Selectable text laid over a scanned image, particularly right across the batch number or purity fields.
• The chromatogram embedded as an image at a different resolution or crop from the rest of the page.
• A signature placed as an image with visible cut-out edges while the rest of the document is clean digital text.
• A digital signature that fails validation, or no digital signature at all on a document that declares itself controlled.
• Author fields or metadata pointing to a company other than the laboratory that signs the report.

Signals, possible explanations and how to verify them

When the COA is genuine and still not enough

The most common documentation failure is not forgery, it is scope. USP general chapter 1503 lists the quality attributes discussed for a synthetic peptide substance: identity, purity and related impurities, net peptide content, counter-ions, water content, residual solvents, microbial burden and bacterial endotoxins ^[8]. A perfectly genuine COA reporting only an HPLC purity figure covers one of those eight — and even that one narrowly, since a chromatographic purity percentage is not the same quantity as the peptide content of the vial. It is not falsified; it is partial, and your record should state what was not measured.

That the remaining percentage is not theoretical is shown by a published incident: synthetic peptide libraries from two independent commercial suppliers were found to contain foreign peptides at roughly 1% by weight, enough to produce false-positive results in immunological assays ^[9]. This is a laboratory finding in in vitro assays, not a clinical study in humans, and it concerns specific lots from specific suppliers. Its relevance to document checking is direct all the same: the declared purity was high and the certificate genuine, while the impurity was real and biologically active.

One thing the category avoids saying should be said plainly: there is no published, independent survey of how often COAs in the research-peptide market are falsified. Any percentage in circulation is a vendor or forum estimate, not a measurement; the nearest available evidence is what independent testing has found inside grey-market vials, and that describes the material rather than the paperwork. The documents cited here are regulatory and pharmacopoeial, written for drug substances ^[1][2][8], alongside accreditation standards ^[3][6]. They work as a benchmark and as vocabulary, not as statistics for this trade — and an estimate does not belong in a laboratory record.

What to do when something does not verify

A failure to verify is not an accusation and does not require you to prove intent. It is a documentation state, and it is handled procedurally — the same way a laboratory handles any material of uncertain provenance.

• Record the finding in the receiving log, with the date and exactly what could not be verified.
• Keep the file as received, without renaming or re-saving it in a way that destroys the metadata.
• Quarantine the material rather than moving it into normal stock until the question is closed.
• Ask in writing for the missing items, naming the specific fields rather than asking in general terms.
• If the laboratory does not recognise the report, record the reply verbatim and stop treating the document as evidence.
• Do not substitute belief for documentation: «the supplier is well known» is not a check.

EOF, Ε.ΣΥ.Δ. and what is actually checkable in Greece

One point causes persistent confusion: a COA is not a regulatory approval, and no COA is approved by the National Organisation for Medicines (ΕΟΦ). The agency supervises medicines and related products; research-use-only material is not a medicine and acquires no status from being accompanied by a certificate of analysis. Conversely, a document that hints at regulatory approval for such material is itself a signal: it asserts something that does not exist.

Where the Greek infrastructure genuinely helps is elsewhere. Accreditation to ΕΛΟΤ EN ISO/IEC 17025:2017 applies to the testing laboratory rather than to the product, is granted per method and per scope ^[3], and the Hellenic Accreditation System publishes the corresponding catalogue with search by name and certificate number ^[4]. It is the one claim on a COA that a third party can confirm without a sample, without equipment and within minutes — which is exactly why it is the first one worth checking.