How to Spot a Fabricated Certificate of Analysis

Anyone can print a document that says 99 percent pure. That sentence sits on the front page of this laboratory's website because it is the whole problem in one line.

A Certificate of Analysis is a PDF. PDFs are editable, and the parts of a certificate that read as authoritative, the letterhead, the layout, the technical vocabulary, the careful limiting language at the bottom, are the parts that require no laboratory whatsoever to produce. The better fabrications reproduce them accurately, because whoever made them understood that those are the elements people pattern-match on.

So visual assessment is the wrong tool. What follows are the structural tells, roughly in order of how much weight to put on them.

The one that matters: does anything point outside the document

Every claim on a fabricated certificate terminates inside the certificate. The purity figure is asserted by the document. The laboratory is named by the document. The method is stated by the document. There is nothing on the page that can be checked anywhere else.

That is the actual signature of a fake, and it is more reliable than any individual field, because a fabricator controls every word on the page and controls nothing outside it.

So the first question is not whether the certificate looks right. It is: what on this page can I confirm without going through the person who gave it to me?

Usually the answer is a verification key that resolves at the issuing laboratory's own domain. Sometimes it is a laboratory that answers a direct inquiry about a report number. Occasionally it is neither, and the certificate is simply unverifiable, which is worth knowing before it gets treated as proof of anything.

Where the verification actually lands

This is where a careful fabrication gets caught, and it is worth being precise about the failure mode.

A certificate carrying a QR code or a verification link is not thereby verified. The question is where it resolves. A code that lands on the supplier's own website, on a page the supplier controls, has verified nothing: the party making the claim is also hosting the confirmation of the claim. The same is true of a link to a file-sharing service, a folder of PDFs, or any page whose contents the seller can edit.

Verification is only verification when the record sits with the laboratory named on the certificate, on that laboratory's own domain, reachable by a route you can arrive at independently. The practical version: do not scan the code. Type the laboratory's domain into the address bar yourself, find its verification page, and enter the key manually. If the key came from a genuine certificate that costs thirty seconds. If the code was pointing somewhere else, you have just found out.

The check almost nobody runs

Assume the key resolves and the record is real. There is a second question, and skipping it is the most common failure in this entire process.

Who was the certificate issued to?

A genuine certificate belonging to a different company is a real record that says nothing whatsoever about the vial you were sold. Recirculating another supplier's certificate is one of the more effective ways to dress up an untested product, precisely because every check short of this one passes. The key is valid. The laboratory is real. The result is genuine. It is simply somebody else's result.

Our register shows the client each certificate was issued to for exactly this reason. When the name on the record is not the supplier who handed you the document, the correct interpretation is not that the certificate is fake. It is that the certificate is not theirs.

Numbers that no instrument produced

Fabricated results tend to be tidier than real ones, because whoever wrote them was picking values rather than reading them.

Round figures. Chromatographic integration produces values like 98.7 or 99.3. A certificate reporting exactly 99 percent, or exactly 99.9, is describing a target rather than a measurement.

Identical figures across a catalog. Real samples differ, so real results scatter. A supplier whose entire product range tests at the same purity, batch after batch, is publishing a specification and calling it analysis.

Purity above what the method can support. Reported purity finer than the resolution of the stated method, or figures like 99.99 percent from routine area percent integration, overstate what the technique delivers.

A purity figure with no method. Area percent depends on the gradient, column, run length and detection wavelength. A number attributed to no method is unanchored, cannot be compared and cannot be reproduced. This is not by itself evidence of fabrication, since some genuine laboratories report thinly, but it removes every ability to check.

Identity asserted rather than shown. A certificate stating that identity was confirmed, without reporting the measured molecular weight against the theoretical value, has printed a conclusion. The two numbers are the confirmation.

Why a chromatogram picture is not evidence

This one runs against instinct, so it is worth stating plainly: an image of a chromatogram on a certificate does not establish that a test occurred.

An image is a picture. It can be redrawn, generated, lifted from another report, or reused unchanged across batches that were never tested. A visually convincing trace is easier to produce than a real analysis, and it is more persuasive to most readers than any field on the page, which is an unfortunate combination.

This does not mean traces are worthless. Instrument data is genuinely informative in the right hands, particularly the impurity pattern rather than the main peak. But it is supporting detail whose value comes entirely from the credibility of the laboratory that produced it, and it is retrieved from that laboratory rather than accepted from a supplier's PDF. If a trace matters for a decision, request it from the issuing laboratory quoting the certificate reference, and read it in that context.

The proof is the record. The picture is illustration.

The laboratory itself

A handful of checks apply to the issuer rather than the result.

• A physical address. Not a logo alone, not a post box in a jurisdiction with no relationship to anything else on the document. An address is a claim someone can be held to, which is why fabrications avoid them.
• An independent web presence. The laboratory should exist as an entity you can find without a link from the supplier.
• Contact details on its own domain. A laboratory contactable only through a free email account is difficult to hold to anything.
• A stated relationship to the product. A laboratory that tests should not also be selling the compound it certified, and an honest certificate says which side of that line the issuer sits on.

Language that gives it away

Genuine certificates are narrow documents and they read as narrow.

Results pertain to the sample submitted. A certificate is not a product approval, not a safety certification, not an authorization for any regulatory purpose. That limiting language is present on honest certificates and its presence is a good sign, not a hedge.

Fabricated ones drift toward endorsement, because they are written to sell rather than to report. Wording that certifies a product as safe, approves it, or vouches for the supplier has confused what a laboratory does. Laboratories measure samples. They do not underwrite companies.

The counterpart tell is a certificate that copies the disclaimer language accurately but shows no measured data behind it, which is a document wearing the costume of a result.

A practical sequence

1. Find the verification key or report reference on the certificate.
2. Type the issuing laboratory's domain into the address bar yourself. Do not use the QR code or the supplied link.
3. Enter the key. Confirm a record exists.
4. Compare the recorded result to the document. The register is authoritative if they disagree.
5. Check the client name on the record against the supplier who gave you the certificate.
6. Match the batch identifier on the certificate to the batch marking on the vial.

Six steps, a couple of minutes, and it does not depend on being able to read a chromatogram or knowing what a reasonable purity figure looks like. It depends only on whether the claim has a source outside the document.

Read next: how verification works and what a match does and does not prove. Or check a key now.