Are Your Supplier's COAs Real? How to Verify Raw Material Testing

Subtitle: Because trusting a PDF from a stranger on Alibaba is not a quality system.

---

Here's a stat that should make your stomach drop: an industry survey of dietary supplement raw materials found that roughly 1 in 4 botanical ingredients are adulterated or mislabeled at the supplier level — the exact problem botanical identity testing exists to catch. That's not edge-case stuff. That's your ashwagandha. Your elderberry. Your lion's mane. One out of four.

And here's the kicker: almost every one of those adulterated batches came with a COA saying it was 100% pure.

The supplement supply chain has a paperwork problem. COAs get Photoshopped. Test results get copy-pasted from one batch to the next. Accredited lab logos get stolen off Google Images and slapped onto fake documents. And if you're not verifying what your supplier sends you, you're accepting their fiction as your fact.

Let me show you exactly how this fraud works — and how to catch it.

---

The Four Flavors of COA Fraud

1. The Photoshop Special

Straight-up forgery. Someone takes a real COA from a legitimate lab, opens it in Photoshop or even just a PDF editor, and changes the numbers. Your magnesium glycinate suddenly went from 8% elemental magnesium to 12%. The lead dropped from 1.2 ppm to <0.1 ppm. The lot number changed to match your order.

I've seen COAs where the font on the altered numbers didn't even match the rest of the document. The scammer used Arial while the original was in Times New Roman. They didn't even try.

How to catch it: Call the lab. Not the number on the COA — the actual lab's number from their website. Read them the COA number and batch ID. Ask "did you test this batch?" If the answer is no, or the dates don't match, or the results are different, you've got your answer. This takes 5 minutes.

2. The Recycled COA

The supplier tested batch #001 in 2023. It was perfect. Now they're shipping you batch #023 in 2025 and they sent you... the same COA from batch #001. They just changed the date in the corner.

This is actually more common than outright forgery because it's less effort. The COA is "real" in the sense that a lab did generate it — just not for your batch.

How to catch it: Compare COAs across multiple batches. Do the results change? Do the lot numbers increment? Are the dates sequential? If every COA for two years shows exactly 15.2% curcuminoids to three significant digits, that's statistically impossible unless they're making meth in a lab with a 0.0001% process variation, which they're not. Real raw materials vary.

3. The "We Follow ISO Methods" Lie

Some COAs list ISO or USP methods on every line but don't mention accreditation anywhere on the document. "We follow ISO 17025 guidelines" is not the same as "we are ISO 17025 accredited." The difference is someone checking your work vs. no one checking your work.

How to catch it: Look for an accreditation body logo (ANAB, A2LA, IAS, Perry Johnson) AND an accreditation certificate number. If neither is present, you're looking at an unaccredited report. That doesn't automatically mean it's fake, but it does mean nobody outside that company has verified they know what they're doing.

4. The Creative Rounding

The numbers are real. The tests were run. But the results say "Pass" for every parameter with no actual values shown. Or worse — the actual value exceeded the limit, but someone decided it was "close enough" and marked it Pass anyway.

I once saw a heavy metals COA where arsenic was 1.8 ppm against a 1.5 ppm limit. The result column? "Conforms." It absolutely did not conform. Someone just didn't like the number.

🚨 The Most Dangerous Four-Letter Word

"Pass." If that's all you see in the results column for 47 rows, you're not looking at a COA. You're looking at a marketing document. Real COAs show actual values, detection limits, and uncertainty ranges. If a lab won't show you the raw numbers, assume the raw numbers are ugly.

---

The Split Sample Method: Your Insurance Policy

Here's the single most powerful verification technique in supplement testing, and almost nobody does it:

You take raw material from your supplier's batch. You split it into two identical samples. One goes to the supplier's lab. The other goes to an independent accredited lab of your choosing. Both labs test the same parameters. You compare the reports.

If the results match within normal analytical variation (±5–10%), your supplier is honest and their lab is competent. Congratulations.

If the results don't match? You've got a problem. And you now have proof — not suspicion, proof — that either their lab is wrong or their COA is fake.

The split sample costs you maybe $300–600 in independent testing. That's less than the margin on a single production run. And it's dramatically less than what you'll lose if you get caught selling adulterated product.

---

What a Real COA Actually Looks Like

Let me paint you a picture of the real thing:

Header: Lab name, physical address (not a PO box), phone number that a human answers, accreditation logo with a certificate number you can verify online, and often a QR code that links to the digital verification page.

Sample info: Your company name, a specific product description, a unique batch/lot number, date received, date analyzed, date reported. All three dates should be recent. All three dates should be different from each other — a COA date and an analysis date that are identical means nobody actually reviewed the results.

Methods: Every test parameter lists the method used (USP <561>, AOAC 999.10, etc.). If you see vague entries like "HPLC method" or "in-house method," that's a red flag. Legit methods have specific compendial references or validated in-house method codes.

Results: Actual numerical values with units. Detection limits. Acceptance criteria. A clear Pass/Fail determination based on the numbers, not vibes. (If any of those terms are unfamiliar, our walkthrough on how to read a COA decodes every line.)

Footer: Analyst name and signature, reviewer name and signature, approval date. Sometimes a QA stamp. At least two human names should appear on the document.

Page numbering: Page 1 of 4, Page 2 of 4, etc. Every page numbered. A COA that's one unnumbered page with everything crammed in 8-point font is not a real COA — it's a summary someone typed up.

---

The Phone Call Test

I'm dead serious about this one. Pick up the phone and call the lab on the COA.

"Hi, I'm reviewing a COA from your lab, report number XYZ-2025-0442, dated March 12. Can you confirm this is a genuine report that your lab generated?"

Best case: they say yes, everything matches, and you feel good.

Medium case: they say they need to check and call you back. Fine. Let them do their due diligence.

Worst case: they have no record of the report, the COA number doesn't match their format, or the phone number doesn't work. In any of these scenarios, you just saved yourself thousands of dollars and a potential lawsuit. Five minutes on the phone is the cheapest quality control you'll ever do.

💡 Tip

Don't use the phone number printed on the COA. If the COA is fake, the phone number might route to the scammer. Google the lab's name, find their real website, get the real phone number, and call that one instead. Paranoid? Yes. But I've seen scammers set up VoIP numbers that forward to their cell phones. It's not paranoia when they're actually after you.

---

Red Flags I've Personally Seen

1. The COA is a Word document. A .docx file instead of a PDF. With track changes still visible. I wish this was a joke.

2. The lab address is a residential home. Google Maps the lab's address. If it's a house in suburban Ohio with a swingset in the backyard, that's not an analytical lab. That's a guy with a pH meter.

3. The ISO logo is pixelated. Accreditation bodies provide high-resolution logo files to accredited labs. A blurry, pixelated ISO logo means someone screenshotted it off Google Images.

4. Chinese supplier, American lab, European accreditation body. There are legitimate labs in China with international accreditations, but a Shenzhen supplier using a lab in rural Wyoming that's accredited by a body in Latvia? That's a shell game. Trace it.

5. Results that are too perfect. Every heavy metal exactly at the detection limit. Every active exactly at 100% of label claim. Real chemistry is messy. Perfect numbers are suspicious.

---

FAQ

Q: My supplier says they use an "in-house lab." Should I trust their COA?

In-house labs can be legitimate — many large contract manufacturers have excellent internal QC labs. But an in-house COA is inherently biased. The lab works for the people selling you the material. Always verify with an independent third-party lab on at least your first batch and periodically thereafter.

Q: How often should I do split-sample verification?

Every new supplier gets split-sample verification on their first three batches. After that, if results are consistently matching, you can drop to every 5th batch. If you change suppliers or the supplier changes their raw material source, start over.

Q: What if the supplier's COA and the independent lab's results disagree slightly?

Small disagreements (within 10–15%) can happen due to normal analytical variation, sampling differences, or different methods. Big disagreements (>20%) are fraud or incompetence. The key is investigating, not just shrugging and moving on.

Q: Can I just ask the supplier for their raw material supplier's COA?

You can ask. Whether you get a real one is another question. Most suppliers won't disclose their sources, and even if they do, you'd be verifying a COA from a company you've never heard of. The split-sample method cuts through all of this — you test the material that's in front of you, regardless of what paperwork trail says.

Q: Are Chinese supplier COAs more likely to be fake?

Fraud exists everywhere, but Chinese raw material markets have a well-documented problem with COA fraud and ingredient adulteration. Not because Chinese suppliers are inherently dishonest — many are excellent. But because the supply chain is long, the dollar incentives are huge, and the distance makes verification harder. Test everything from every supplier, but triple-check anything coming through a broker you don't have a direct relationship with.

---

The Bottom Line

Your supplier's COA is a starting point, not a finish line. It tells you what they claim the material is. It doesn't tell you what the material actually is. The difference between those two things is your entire product liability.

The good news: verification isn't complicated. Split samples. Phone calls. Accreditation checks. Compare COAs across batches. None of this requires a chemistry degree. It just requires not being lazy.

At LabQuotes, we connect you with accredited independent labs that will run your split-sample verification and give you real results you can compare against your supplier's paperwork. No Photoshop. No pixelated logos. No "Pass" without a number.

Verify your supplier's COA →