Full disclosure, I work for Peptriva (research-use-only compounds), so read this knowing that. Can't help with anything use-related, but stolen COAs are worth talking about because they're getting more common, not less.
The frustrating part is a stolen COA looks exactly like a real one, because it is one. It's just someone else's. A few ways to actually catch it:
Check the lot number against what's on the vial you'd receive. Ad-scam sites reuse one document across every product, so the lot either doesn't match anything or shows up on ten different listings.
Reverse-image-search the COA or google a distinctive string from it. If the same doc shows up on another vendor's site, there's your answer.
Email the lab on the letterhead and ask if they tested that lot for that company. Real labs answer this.
Janoshik does, and any ISO 17025 lab will confirm or deny a report they issued. A vendor whose COAs survive that phone call has nothing to hide, and honestly that's the test I'd want buyers applying to us too.
And yeah, the fact that these accounts block anyone who asks for documentation tells you everything before the COA does.
