Having a COA on your packaging does not mean your product was tested. In the hemp market, where enforcement is limited and lab testing requirements vary widely by state, fabricated, altered, and selectively incomplete Certificates of Analysis are common enough to have earned their own category of consumer fraud. Some come from real labs that agreed to produce favorable results in exchange for exclusive contracts. Some are PDF documents where the numbers have been edited. Some are legitimate tests applied to different products. Knowing the red flags is not paranoia. It is the only defense a consumer has.
🧪 Lab Tested | 👩💼 Woman-Owned | 🏆 Est. 2017
Why COA Fraud Exists
Full-panel laboratory testing is expensive. A complete test covering cannabinoids, terpenes, pesticides, heavy metals, residual solvents, mycotoxins, and microbials can cost several hundred dollars per batch. For small operators producing frequent batches of multiple products, testing costs add up to a significant line item. The financial incentive to skip, abbreviate, or falsify testing is real.
The hemp market compounds this problem. Unlike the regulated cannabis market in most states, where testing is mandatory and results are reported to a state agency, hemp products are sold federally with minimal required testing documentation. A brand can put “lab tested” on a hemp product with nothing backing it up. Consumers have no centralized database to check. The only verification tool is the COA itself, and the only way to use that tool is to know what a bad one looks like.
COA fraud takes several distinct forms. In one form, a legitimate lab produces a real test on a real sample, but the sample submitted is not representative of the actual product. In another, a real COA from one batch is applied to a different product entirely. In a third, the document itself has been edited after the fact, with numbers changed in a PDF editor. And in the softest form of fraud, a brand simply uses a lab that it knows will produce favorable results: not because the lab fabricates data, but because its methods are loose enough that contaminated products pass anyway.
The hardest fraud to spot: A lab with loose method limits or non-accredited testing that technically produces real results. The numbers are genuine. The problem is that the detection thresholds are set high enough that contamination at dangerous levels still reports as a pass. Accreditation, not just the existence of a COA, is the critical verification point.
Ten Red Flags to Check
Run through this list the next time you evaluate a COA, especially from a brand you haven’t purchased before.
1
No accreditation number
Every legitimate testing lab includes its ISO 17025 accreditation number on the COA. If it’s absent, the accreditation cannot be verified. A brand claiming “ISO 17025 accredited lab” with no accreditation number visible on the COA is making an unverifiable claim.
2
No batch code or sample ID
A COA that lacks a specific sample ID or batch code does not trace to a specific product run. It could have been produced for a different product entirely, or produced for a sample that was never actually sold. Batch codes are the chain of custody between the test and the product in your hand.
3
Results that are suspiciously round
Real analytical results are not round numbers. A cannabinoid result of exactly 20.00% or a pesticide result of exactly 0.00 ppm (rather than ND) should raise questions. Legitimate measurements include decimal variation. Perfectly round numbers across an entire panel suggest either data manipulation or a method that isn’t actually measuring at the claimed precision.
4
Missing test categories
A COA that covers only cannabinoid potency is not a safety document. It is a marketing document. Any COA used as evidence of product safety must include at minimum residual solvents, pesticides, and heavy metals. For vape products specifically, residual solvents and cutting agents are the most critical. Vitamin E acetate, the compound linked to the 2019 EVALI crisis, appears in this section.
5
Stale test date
A COA dated 18 months ago does not cover the product you are holding. Legitimate operators test every batch, which means the test date on the COA should correspond to the production date of that specific batch. A brand that shows only one or two COAs for all its products, or COAs dated years in the past, is not testing each production run.
6
Lab is affiliated with the brand
A lab that tests exclusively for one brand, is financially tied to the operator, or is listed at the same address as the brand is not independent. Third-party means no financial relationship. A lab that depends on one brand for most of its revenue has a structural incentive to produce favorable results.
7
Results contradict the label
A product labeled “Delta-9 THC Free” with detectable Delta-9 on the COA. A “CBD isolate” with a rich terpene profile. A “full spectrum” product with a cannabinoid panel that shows only one cannabinoid. The COA should confirm what the label claims, not contradict it. Any mismatch (in either direction) suggests either a labeling error or a COA that does not correspond to this product.
8
Font inconsistencies or formatting oddities
Altered PDFs often show font mismatches, spacing inconsistencies, or characters that do not quite align with the rest of the document. Run the COA through a PDF viewer at high zoom. Results that look like they were typed over existing numbers, or fields where the text doesn’t match the surrounding font, are signs of post-production editing.
9
Broken or mismatched QR code
Many legitimate labs include a QR code that links directly to the result in the lab’s own database. If the QR code doesn’t work, links to a generic product page, or opens a different COA than the one printed, the document has been separated from its source. A COA that cannot be verified through the lab’s own system should not be trusted.
10
Every result lands just below the action limit
If every contaminant result in a pesticide or heavy metals panel lands at exactly 90% of the action limit batch after batch, the results were not produced by random sampling. Real analytical results show natural variation. Systematic results that park just below pass thresholds are a statistical improbability that suggests the data has been adjusted to pass rather than measured to discover.
What a Legitimate COA Always Includes
A properly produced COA from an accredited lab contains these elements without exception.
- Lab name, address, and ISO 17025 accreditation number
The accreditation number should be searchable through the accrediting body’s public directory. Common accrediting bodies in the United States include A2LA and PJLA. The accreditation should cover the specific test categories on the COA, not just be a general lab certification. - Unique report number and analyst signature
Professional lab reports carry a unique document number that traces to the lab’s internal records, and the signature or initials of the analyst who ran the test. These exist to create accountability. If neither is present, the document has no chain of custody from the lab to the result. - Specific sample ID and batch code
The sample ID on the COA should match a batch code that appears on the product packaging. One number on both. It traces the specific product you are holding to the specific test that was run on it. - Recent test date relative to product production
The test date should correspond to the production period of the batch being sold. A COA for a product produced this quarter should have a test date from this quarter or the immediately preceding one. Significant time gaps between the test date and the product availability date warrant explanation. - Full panel with action limits listed
Each tested category should show both the detected result and the applicable action limit. For contaminants, the action limit is the threshold above which the product fails. If a COA shows results without action limits, there is no way to determine from the document whether the result is a pass or a fail. - Pass/fail summary for each category
Professional COAs include a summary pass or fail designation for each test category. Some also include an overall pass/fail for the entire panel. If there is no pass/fail designation and the COA only shows numbers, you have to calculate compliance yourself by comparing each result against its action limit, which is worth doing if the pass/fail summary is absent.
How to Verify a COA in Five Minutes
Reading a COA is not enough. The document in front of you needs to be confirmed as genuine through at least one verification step that cannot be faked with a PDF editor.
- Search the lab’s name independently. Do not follow links provided by the brand. Search the lab name directly and confirm it is a real facility with a verifiable address and published accreditation. Labs that exist only in a brand’s marketing materials are a warning sign.
- Look up the accreditation number. Go to the accrediting body’s database directly (A2LA, PJLA, or the relevant body in your state) and search for the accreditation number listed on the COA. Confirm the lab is currently accredited and that its accreditation covers the specific test categories listed on the document.
- Scan the QR code if present. A legitimate lab QR code opens the result directly in the lab’s database, not a brand webpage. The result you see should match the document. If the QR opens a product page, a marketing site, or a generic COA library without matching the specific batch number, the chain of custody is broken.
- Match the batch code. Find the batch code on the product packaging and confirm it appears on the COA. The codes should be identical. A one-character difference means either a labeling error or that the COA does not correspond to this product.
- Look for the report number in the lab’s system. Some labs allow you to search their results database directly by report number. If the lab does not offer this and has no other verification mechanism beyond a QR code, treat the COA as unverified until you can confirm it through another channel.
What to do when you cannot verify a COA: Contact the brand and ask directly for the lab’s contact information and the report number. A brand with legitimate testing can always provide both. Reluctance to provide the testing lab’s contact information is itself a red flag. A brand that does its testing honestly has no reason to keep its lab a secret.
TribeTokes COAs: All batch-specific results are publicly available at tribetokes.com/certificates-of-analysis with batch codes traceable to product packaging. Full-panel testing by an independent ISO 17025-accredited laboratory. If you have questions about a specific batch result, email team@tribetokes.com.
Frequently Asked Questions
More common than most consumers assume. The hemp market operates with minimal federal testing requirements and no centralized database where results can be independently verified. Multiple investigative reports and state-level enforcement actions have found that a meaningful percentage of COAs on hemp products either do not correspond to the product being sold, cover only potency testing while skipping safety categories, or were produced by labs without accreditation for the methods they claim to use. The absence of easy fraud detection is what makes fraud easy.
Yes, in several ways. A real lab can test a cherry-picked sample that does not represent the actual batch. It can apply loose detection thresholds that allow contamination at dangerous levels to pass. It can test only the categories a brand is likely to pass and skip the ones where failure is probable. And a lab that derives most of its revenue from one brand has a conflict of interest that may not produce outright fabrication but does create systematic pressure toward favorable results. A real lab with a conflict of interest is not meaningfully different from a biased one.
Selective incomplete testing (presenting a COA that covers only cannabinoid potency and calling it “fully tested”) is the most widespread issue because it is technically legal in most states, requires no forgery, and is difficult for consumers to recognize without knowing what a complete panel includes. Potency-only testing tells you the product is what it claims to be in terms of cannabinoids. It tells you nothing about whether it contains pesticides, residual solvents, heavy metals, or cutting agents.
Look up the accreditation number listed on the COA directly through the accrediting body’s public database. In the United States, A2LA (American Association for Laboratory Accreditation) and PJLA (Perry Johnson Laboratory Accreditation) maintain searchable databases. Search for the lab by name and accreditation number, and confirm the accreditation is currently active and covers the specific test categories listed on the COA. Accreditation is category-specific: a lab can be accredited for cannabinoid potency but not for pesticide analysis.
“ND” (not detected) is the correct scientific notation for a result below the method’s detection limit. “0.00” is not. Every analytical method has a minimum detection threshold; results below that threshold cannot be accurately measured and should be reported as ND, not as a specific number. A COA that reports 0.00 for every contaminant rather than ND suggests either that the test was not actually run, or that results were manually set to zero rather than generated by the analytical instrument.
Yes. A PDF document can be edited with standard software, and the alterations are not always visible to the naked eye at normal viewing resolution. Common edits include changing a failing result to a passing number, adding pass designations that were not in the original, and replacing the lab’s name while keeping the formatting. Zooming in to 200% or higher on a PDF will often reveal font inconsistencies, misaligned characters, or pixel artifacts where a number has been placed over another. The only reliable defense is verification through a source the brand cannot control, such as the lab’s own searchable database or a QR code that links directly to the lab’s system.
Selling a product with a fabricated COA is fraud and may violate FDA regulations around misbranding and adulteration in addition to state consumer protection laws. Selling a product with an incomplete COA that omits safety categories is generally legal in states without mandatory full-panel testing requirements for hemp, which describes most of the country. The legal gap between “technically permitted” and “genuinely tested” is wide, and it is the space where most consumer harm from inadequate hemp testing occurs.
Contact the brand and request the testing lab’s name, address, and the specific report number for the COA in question. Then contact the lab directly to confirm the report exists in their records. If the brand refuses to provide the lab’s contact information, or if the lab cannot confirm the report number, you have either a fraudulent COA or a testing program with no chain of custody. Report suspected fraud to your state’s department of agriculture or consumer protection agency. For hemp products specifically, the FDA maintains a consumer complaint mechanism for mislabeled or adulterated products.
TribeTokes COAs: Every Batch, Full Panel, Publicly Available.
Independent lab testing with batch codes traceable to packaging. Woman-owned since 2017.