Fake peptide COAs and fake Janoshik reports: how they're made and how to catch them

A vendor posts a certificate of analysis showing 99% purity. It has a lab logo, a chromatogram, a signature block. It looks exactly like every other COA you've seen. And in a case Vanguard Laboratory described in July 2026, its operations manager confirmed to CBS News that the certificate was completely fabricated: the lab hadn't issued it, didn't have the vendor as a client, and the chromatogram pictured on the certificate belonged to a different peptide than the one printed in the header.

That's the uncomfortable thing about a COA. It's a PDF. Nothing stops anyone from opening one in an editor and changing a number, and in a market with no regulator checking anyone's homework, some people do exactly that. This post is about how that happens in practice, two documented cases, and the specific things worth checking before you treat a report as real. If you haven't already, read how to read a peptide COA first — this post assumes you know what the fields mean and focuses on how they get faked.

Why forgery is easy and detection is too

Faking the look of a COA is trivial. Logos are public. Fonts are copyable. Typing "99.2%" into a purity field takes five seconds. What's much harder to fake is the underlying chemistry — a real chromatogram is a specific, reproducible fingerprint of a specific molecule, and it's expensive and slow to generate a convincing fake one from scratch. So most forgeries don't bother. They reuse something real instead of inventing something fake, which is exactly what makes them catchable if you know where to look.

Why someone bothers forging a report

It helps to think about the incentive plainly. A real, independent test costs real money and takes real time — the vendor has to pay for the test, ship a sample, and wait, and the result is out of their hands once it's submitted. If the result comes back bad, they've paid for evidence against themselves. Forging or reusing a report skips all of that: no cost, no wait, no risk of an inconvenient number coming back. The forger isn't trying to fool a chemist. They're trying to satisfy a buyer who's scrolling a storefront, sees a lab logo and a purity percentage, and moves on. Most buyers never open the PDF's metadata, never zoom in on the chromatogram, and never think to visit a lab's own site and type in a code. The forgery doesn't need to be good. It just needs to not get looked at closely, which is exactly why looking at it closely is the whole defense.

The patterns we see described

None of the following is exotic. It's the small set of moves that keep showing up whenever someone examines a bad COA closely.

Edited numbers on a real template. The easiest fake starts as a real report — the vendor's own, a competitor's, or one pulled off a forum — with the purity or amount changed in an editor. Fonts sometimes don't quite match around the edited field, or the numbers don't add up against the chromatogram still pictured on the page.

A report reused across batches or products. A vendor runs one real test, then attaches that same PDF to every batch of the same product going forward, or to a different product entirely. The label on the vial changes; the paperwork doesn't. The Vanguard Laboratory case is a clean example of the extreme version: the forged retatrutide certificate actually showed a chromatogram for tirzepatide, a different compound with a different structure. As Vanguard put it, whoever built the fake "didn't even bother to match the analytical data to the label on the vial."

A cropped or swapped verification code. Some labs, including Janoshik, print a task number and a unique key on every certificate and let anyone check them against the lab's own database. A forged or misapplied report will often have that code cropped out of the image, blurred, or simply missing — because including a real, checkable code defeats the point of reusing someone else's report.

A verification code that belongs to a different sample. The sharper version of the problem above: the code is still there, but it points to something else entirely. This is documented, not hypothetical. In one case described in a Peptide Protocol Wiki review of Janoshik, a vendor posted what was presented as a Janoshik certificate of analysis for NAD+ with the report's key and QR code removed from the image. When the underlying task number was checked against Janoshik's own system, it corresponded to a test for bacteriostatic water — an unrelated product with nothing to do with the peptide being sold. The report hadn't been invented from nothing; a real Janoshik result for a different item had been relabeled as something else.

A reused chromatogram image. Even when a fake includes a chromatogram, it's sometimes a screenshot or image pulled from another report, another product, or a stock example — which is how a "retatrutide" certificate ends up showing a tirzepatide peak shape, or a suspiciously low-resolution, cropped graph that doesn't match the rest of the document's print quality.

A fabricated lab name. Instead of impersonating a real, checkable lab, some COAs invent one — a lab name and logo with no real address, no way to reach it independently, and no test-verification system at all. There's nothing to cross-check because the "lab" doesn't exist outside the PDF.

A manufacturer's own COA presented as independent. This one isn't forgery in the strict sense — the document may be entirely genuine — but it's still misleading. A certificate written by the same factory that made the product is a manufacturer's internal QC record, not a third-party check. Presenting it without saying who tested it, or letting a buyer assume it came from an outside lab, blurs a distinction that matters. This is exactly why VendorVerify doesn't use a manufacturer's or vendor's own certificates at all: every report in our data comes from an independent lab, and most were commissioned by a buyer, on a vial the buyer received. When a vendor paid an outside lab itself, we label that report and count it at half weight.

How this usually gets caught in practice

Group-test organizers, buyers who pool money to test a batch and share results across a forum or chat rather than relying on whatever a single vendor posts, are among the most skeptical readers in this market, and for good reason. They're often the ones who first notice a report doesn't add up, because a group test produces something a vendor's own marketing can't: several buyers, several vials from the same claimed batch, and several independent chances for the paperwork to be inconsistent. If one buyer's "independent" report and another buyer's "independent" report for the same batch turn out to be the identical PDF, that's caught the moment two people compare notes, not through any special expertise.

This is also why a report tied to a specific, checkable identifier matters more than it might seem. A forger reusing a PDF across many buyers is betting that no two of those buyers will ever compare documents. A verification code that resolves to one specific task, tested once, makes that bet much worse for the forger — either the code is missing or cropped (itself a red flag, per the pattern above), or it's present and eventually gets checked by someone who notices the product name doesn't match what the lookup returns.

Two documented cases, in brief

It's worth being specific rather than vague about this, because vague warnings ("fakes exist!") don't help anyone check anything. Two cases with a citable source:

Two cases isn't a statistic and we're not treating it as one — we're not going to hand you a made-up percentage of "how many COAs are fake," because nobody actually knows that number and anyone who states one with confidence is guessing. What these cases show is the mechanism: forgers reuse real material rather than invent it from nothing, and that reuse is what leaves a seam to find.

What to actually check

Most of this doubles back to verification, which deserves its own full walkthrough — see how to verify a Janoshik report for the step-by-step on Janoshik specifically. The short version, for any lab:

• Does the lab have a public way to check the report? If a lab publishes a verification page or database — Janoshik does, at its Verify page — use it. A code that doesn't resolve, or a "no test found" result, is the single strongest signal something is wrong.
• Does the chromatogram match the compound on the label? You don't need to be a chemist to notice a peak shape that looks copy-pasted, or a graph that's a different resolution or file quality than the rest of the document.
• Does the batch or lot number on the report match the vial in front of you? A real report for a different batch of the same product tells you nothing about the vial you actually have.
• Can you reach the lab directly, independent of the vendor? Look the lab up yourself rather than clicking a link or calling a number the vendor gave you, and ask them to confirm the certificate number.
• Is the "lab" actually a lab? A name and a logo aren't a lab. A real testing lab has an address, a way to contact it that isn't routed through the vendor, and ideally some track record you can find outside the vendor's own marketing.

These checks take a few minutes. That's the whole point — a genuine report survives them easily, because there's nothing to hide. A forged or misapplied one usually falls apart on the first or second check, because reusing someone else's real data is a shortcut that only works if nobody follows the thread.

A note on report keys in our own data

Of the 1,527 vials in our data as of September 28, 2026, 1,233 have an associated lab report key or ID recorded alongside the result. Some labs and some older reports simply don't carry a checkable identifier, so a missing key in our data isn't by itself a sign that a report is suspect. But it's a useful reminder of why a checkable key matters when one is available: it's the difference between "trust this because it looks official" and "here's exactly where to go confirm it yourself."

If you think you're looking at a fake

Stop treating the certificate as evidence of anything. Contact the lab named on the report directly — using contact information you find yourself, not anything printed on the certificate or given to you by the vendor — and ask them to confirm the report number and vial. If they don't recognize it, you have your answer. From there, it's reasonable to say so publicly (with the specifics, not just an accusation) and to avoid treating any other paperwork from that vendor as reliable until you see something independently verified.

What VendorVerify does and doesn't do here

We only publish results from independent labs, and most of them come from reports a buyer commissioned themselves, on a vial they received. We don't accept a vendor's own certificates. A report a vendor paid an independent lab for is accepted only if the lab can confirm it, and it's labeled and counted at half weight. We don't test anything ourselves.

That doesn't make us immune to a forged submission — no one checking paperwork is immune to that, which is the whole point of this post. What we can tell you in general terms: a submission needs an actual lab report file attached, not just numbers typed into a form, and submissions go through review before anything is published to a vendor's page. We're not going to describe the specifics of that review publicly, for the same reason a lab doesn't publish exactly how it screens for forged samples — publishing the checklist just tells people what to route around. If you submit a report and something about it doesn't add up, expect us to ask questions before it goes live.

If you've spotted what you believe is a faked or misapplied report — for a vendor listed with us or anywhere else — you can tell us through the contact page; it helps to include how you verified it, or tried to and couldn't.

The uncomfortable bottom line

A certificate of analysis is not, by itself, proof of anything. It's a claim, made on paper, by a party with an interest in what you conclude from it. The whole reason independent, buyer-commissioned testing matters — and the reason we built VendorVerify around it instead of accepting vendor paperwork — is that "the vendor's own document says it's fine" has never been a trustworthy sentence in an unregulated market, and forged Vanguard and Janoshik reports are proof that people are willing to exploit exactly that trust. For research use only means for research use only; none of this is a substitute for treating any unregulated compound with real caution regardless of what its paperwork says.