How to Spot a Fake COA: Six Tells From Real Lab Reports

A certificate of analysis is just a PDF, and PDFs can be edited by anyone with twenty minutes and no shame. In an industry where the lab report is the entire legal and commercial basis of the product, that makes forged, doctored, and recycled COAs the quiet epidemic — and the reason "this vendor publishes a COA" is the start of our audits, never the end. The good news: fakes fail in predictable ways. Here are the six tells we check, in the order we check them.

Prerequisite: this guide assumes you can read a legitimate COA — the fields, the formula, the routine. If not, start with how to read a COA and come back; spotting counterfeits requires knowing what the genuine article looks like.

Tell 1: The math doesn't reconcile

The fastest screen, because forgers routinely inflate one number and forget the arithmetic that depends on it. Total THC must equal (THCA × 0.877) + delta-9, and on an honest report it does. Our standing clean control is a Fern Valley Farms batch from our vendor audits: 25.582% THCA and 0.253% delta-9, with total THC stated at 22.688% — recompute it and you get 22.435 + 0.253 = 22.688, exact to the third decimal (full audit here).

Now the counterfeit signature: a label bragging "30% THCA" alongside a total-THC line of 30%. That report just told you its author doesn't know THCA loses ~12.3% of its mass converting to THC. A real 30%-THCA flower tops out around 26.3% total. When the stated total exceeds THCA × 0.877 + delta-9, someone typed a number instead of measuring one.

Tell 2: No batch ID — or a batch that doesn't match

A legitimate COA is tied to one production batch, and that identifier appears on both the report and the product listing or package. The two fraud variants: a COA with no batch/sample ID at all (a lab report describing nothing in particular), and the more common recycled COA — a real report from one batch, reused for months across every batch since. Check the sample-received date against how long that strain has been continuously in stock; a single COA "covering" a year of inventory is paperwork theater. This is exactly why batch-matched documentation outranks per-strain documentation in our vendor rankings.

Tell 3: The lab doesn't check out

A COA is only as real as the laboratory behind it, so verify the lab exists outside the PDF: a findable website, a physical address, and accreditation you can confirm — ISO/IEC 17025 is the searchable standard, and accreditation bodies publish directories of who holds it. Escalations that cost nothing: many labs run online verification portals or QR codes that pull the report from the lab's own server — a report that exists in the lab's system is a report the lab actually issued. And labs will confirm or deny issuing a report if you email them; forgers are betting nobody ever does. Ghost labs, labs with no accreditation trail, or reports whose QR codes resolve to the vendor's own website instead of a lab domain: walk.

Tell 4: Template artifacts

Doctored reports are editing jobs, and editing leaves fingerprints. The classics from our desk audits: fonts that don't match between the edited number and the rest of the table; misaligned columns where a value was pasted over; results tables whose rows don't sum sensibly; the same cannabinoid values, decimal-for-decimal, appearing across "different" strains from the same vendor (real plants don't do that); and lab logos at the wrong resolution because they were lifted from a website screenshot. None of these is proof alone. Two of them on one document is a verdict.

Tell 5: Impossible numbers

Some forgeries fail on chemistry rather than formatting. Screens we run: THCA percentages in the mid-30s and above — elite verified flower generally lives in the 20s, and the further above 30% a claim floats, the more paperwork it owes you; treat "38% THCA" flower listings as fiction until a verifiable lab says otherwise. Cannabinoid tables with no ND or <LOQ entries — real instruments have detection floors, and a report where every minor cannabinoid conveniently registers a round number reads like invention. Missing moisture context — flower potency is reported on a dry-weight basis, and full reports say so. Suspicious roundness — measured chemistry produces values like 25.582%, not an even 25% and 0.3% delta-9 landing exactly on the legal limit. Numbers that flatter the law and the label simultaneously deserve your least charity. (For why the arms-race percentages are dubious even when real, see the percentage reality check.)

Tell 6: The dates are wrong

Every legitimate report carries its chronology: sample received, analyzed, issued. The failure modes: COAs old enough that the tested flower has long since sold through (eighteen months is describing a different product); issue dates that precede the vendor's own claimed harvest; and — the lazy classic — a "current" report tested years ago with the year cropped out of the visible frame. Stale paperwork isn't always fraud; sometimes it's just neglect. Either way it isn't evidence about the bag you're buying.

The two-minute screen, in order

1. Recompute total THC (tell 1). Fails → done.
2. Match batch ID to listing, and date to plausible inventory (tells 2 and 6).
3. Look up the lab; use its verification portal if one exists (tell 3).
4. Scan for editing artifacts and impossible values (tells 4 and 5).

When a COA fails

Don't buy — that part needs no elaboration. If you're feeling civic, email the vendor and ask for the batch-matched report; the reply is its own data point, and in our experience the most common reply to a math question is silence. Vendors that survive this screen consistently are the ones on our ranked board, and the screen is most of the ranking. It's also worth saying that the paperwork problem cuts both ways in this market's final stretch — with the federal ban effective November 12, 2026, some exiting vendors will get less careful, not more. Audit harder as the clock runs down.

And the standing house disclosure, because a fake-COA guide can accidentally imply the real thing is benign: a genuine COA verifies potency and compliance — it does not make THCA flower mild. Heated, it converts to THC; it is intoxicating; it will show on a drug test. Real paperwork, real product, real chemistry. The skill here is making sure all three match.