COA Reuse and Theft, Explained

Reuse

A supplier tests one good batch and gets a genuine COA. Then thousands of vials — many never tested — are sold against that single report. Every reseller buying from that supplier can show the same document, even though your specific vial was never analyzed. One test, an ocean of untested product riding on it.

Theft

A vendor downloads someone else's genuine COA — a competitor's, or their supplier's — and presents it as proof of their product. The document is authentic; it's just not theirs. Posting a real PDF only defeats forgery. It does nothing against a stolen-but-real report.

Why "the PDF is real" isn't enough

People check whether a COA looks legitimate and stop there. But authenticity is the floor, not the ceiling. The real questions are: whose sample was tested, and does the result tie to this vendor and this batch?

How to defeat both

• Insist the COA verifies on the lab's own portal, with the vendor named as the client.
• Prefer independent blind testing — where a buyer purchases off-the-shelf and submits it, so the vendor can't choose the sample.

Related: why two vendors share a COA · how to read a COA.