Check a vendor

These checks catch fake companies and fake paperwork. A lab test of your own vial is the only way to know what's in it.

Last reviewed . About this date

Step 1: Is the company real?

Find it on paper

Search the business name in the registry of the state the company says it’s in. NASS keeps links to every state’s business registration database (NASS), and OpenCorporates pulls company records from official registries in more than 140 jurisdictions (OpenCorporates). The registered name and address should match the website, and the company should show as active. A company you can’t find on paper leaves you nobody to hold responsible.

Check the domain’s age

ICANN Lookup is a free tool that shows when a domain was registered (ICANN, 2021). A domain registered last month has no track record, so weigh it against everything else you find.

Watch how it wants to be paid

The FTC puts it plainly: “if the seller says you can only pay with a gift card, wire transfer, payment app, or cryptocurrency, it’s probably a scam” (FTC, 2025). A credit card lets you dispute a charge for goods that never arrived or weren’t as described (FTC, 2022). Crypto gives you no such protection (FTC, 2026).

Read the reviews like ads

Search the company name with “scam” and “complaint,” as the FTC suggests (FTC, 2023). Then look at who’s talking. A discount code in the reviewer’s name signals a relationship with the seller, according to the FTC (FTC Endorsement FAQ). An FTC rule has banned fake reviews and undisclosed insider reviews since October 2024 (FTC, 2024) (FTC Q&A, 2024).

Compare the label with the marketing

A vendor that stamps “research use only” on its vials while posting dosing charts, describing effects in people, or bundling bacteriostatic water is contradicting its own label. FDA judges a product by its labeling, its ads, and the seller’s own statements (21 CFR 201.128). In 2026, FDA sent warning letters over this to sellers of retatrutide and other peptides (FDA, 2026) (FDA, 2026). One letter said water plus a “peptide calculator” gives buyers “the means to prepare an injectable drug” (FDA, 2026).

Step 2: Are its COAs real?

A certificate of analysis, or COA, is a lab’s report on one sample. Licensed drug makers don’t take a supplier’s COA on faith: federal rules make them run their own identity test on each ingredient before relying on a supplier’s report (21 CFR 211.84). Give a vendor’s COA the same treatment.

Match the batch

ICH Q7, the drug industry’s quality guideline, says a certificate should name the batch it covers (ICH Q7). A COA with no lot number, or a lot that doesn’t match your vial, tells you nothing about what you received.

Make sure the lab is independent

In a May 2026 article for The Conversation, a McMaster University professor wrote that the “third-party” labs behind vendor COAs are often the vendors themselves (Phillips, 2026). Look up who owns the lab. A lab that shares an owner or an address with the vendor isn’t independent.

Confirm the report with the lab

Find the lab’s website on your own, through a search engine, and skip any link the vendor gives you. Use the lab’s report lookup if it has one, or send the report number through the contact details on the lab’s own site and ask it to confirm the results. If the lab can’t find the report, or its copy differs from the vendor’s, don’t trust the COA.

Check the accreditation and its scope

ISO/IEC 17025 is the standard labs use to show they work competently and produce valid results (ISO/IEC 17025). Accreditation counts only for the tests listed on a lab’s scope, and A2LA says anything missing from the scope isn’t covered (A2LA FAQ). Look the lab up in its accreditor’s directory, such as A2LA (A2LA directory), ANAB (ANAB directory), or UKAS (UKAS directory), and check that the accreditor belongs to ILAC’s international arrangement (ILAC). Wording like “ISO 17025 aligned” or “compliant” doesn’t mean accredited. IAS publishes the false claims of its accreditation it has caught (IAS).

This site names no labs

In September 2026 we looked at labs that test peptides for the public. None had accreditation we could confirm for peptide identity or purity testing. One held real accreditation for other kinds of tests; another called itself “ISO/IEC 17025 aligned.” Until a lab checks out, Boof Reta won’t point you to one.

Read the tests, not the headline number

HPLC purity is the big number on most peptide COAs, and it doesn’t prove the vial holds the right peptide. ICH Q6A says a single chromatographic retention time isn’t specific enough to identify a substance (ICH Q6A), and chemists confirm a peptide’s identity with several methods, mass spectrometry among them (McCarthy et al., 2023). Endotoxin needs its own test: FDA’s guidance points to the USP standards that call for it in injectable products (FDA, 2026) (USP <85>). For a field-by-field walk through a certificate, see Reading a COA.

Step 3: Test your own vial

A vendor’s COA describes the sample that lab tested. Your vial isn’t that sample. Ask the lab to quote you for:

Sterility is a separate test. The harmonized USP method incubates samples for at least 14 days, and a pass covers only the units tested, so it can’t clear a whole batch (USP <71>).

The checklist

Vendor checklist

Answer what you can check. Your answers stay on this page: nothing gets sent or saved.

Is the company real?

Can you find the company in a state business registry or on OpenCorporates, under the name on its website?

If no: You have no registered business to hold responsible if the product is bad or never shows up.

Reasons and sources

NASS links to every state's business registry, and OpenCorporates collects company records from official registries in more than 140 jurisdictions.

Source: NASS; OpenCorporates

Does the vendor only take crypto, gift cards, wire transfers, or payment apps?

If yes: The FTC says a seller who will only take those is probably running a scam, and none of them lets you dispute the charge.

Reasons and sources

A credit card lets you dispute a charge for goods that never arrived or weren't as agreed, under the Fair Credit Billing Act. Crypto payments carry no such protection.

Source: FTC, 2025; FTC, 2022; FTC, 2026

Does the vendor post dosing charts, describe effects in people, or bundle bacteriostatic water with a "peptide calculator"?

If yes: FDA treats that as proof the products are drugs for people, whatever the label says, and has sent warning letters to sellers who do it.

Reasons and sources

Federal rules judge a product by its labeling, its ads, and the seller's own statements. In an August 2026 letter, FDA said water plus a calculator gives buyers "the means to prepare an injectable drug."

Source: 21 CFR 201.128; FDA, 2026

Do most of the reviews you found come from people pushing a discount code or affiliate link?

If yes: Read those reviews as ads. Look for accounts from people with nothing to sell before you trust the vendor.

Reasons and sources

The FTC says a code with someone's name on it signals a relationship with the seller. A 2024 FTC rule bans fake and paid-for reviews that hide that relationship.

Source: FTC Endorsement FAQ; FTC, 2024

Are its COAs real?

Does the vendor show a COA with the same lot number you'd receive?

If no: A COA for some other batch tells you nothing about yours. Ask for the one that matches your lot, and pass if the vendor can't produce it.

Reasons and sources

ICH Q7, the quality guideline for drug makers, says a certificate should name the batch and list each test with its limit and result.

Source: ICH Q7

Did a lab with no ties to the vendor run the tests?

If no: A COA from the vendor's own lab, or a lab it owns, isn't independent evidence.

Reasons and sources

In a May 2026 article for The Conversation, a McMaster University professor wrote that the "third-party" labs behind vendor COAs are often the vendors themselves.

Source: Phillips, 2026

Did the lab confirm the report when you looked it up yourself, starting from the lab's own website?

If no: Skip any verification link the vendor hands you. Find the lab's site on your own, then use its report lookup or send the lab the report number.

Reasons and sources

Accreditation bodies warn that counterfeit certificates circulate and tell buyers to check authenticity on their own. Going through the lab's own site means you're asking the lab, not whoever made the PDF.

Source: UKAS; IAS

Does the COA claim an accreditation you can't find in the accreditor's directory, or one that doesn't list these tests?

If yes: A false or stretched accreditation claim tells you the paperwork can't be trusted. "ISO 17025 aligned" means the lab isn't accredited.

Reasons and sources

A2LA says anything missing from a lab's scope isn't covered by its accreditation. A2LA, ANAB, and UKAS let you search their directories, and A2LA and IAS publish the false claims they know about.

Source: A2LA FAQ; A2LA directory; IAS

Does the COA include identity by mass spec and an endotoxin result, on top of HPLC purity?

If no: HPLC purity alone doesn't prove the vial holds the right peptide, and it says nothing about endotoxin. Ask for both before you trust the batch.

Reasons and sources

ICH Q6A says a single chromatographic retention time isn't specific enough to prove identity. FDA's endotoxin guidance points to USP standards that call for testing finished injectable products.

Source: ICH Q6A; McCarthy et al., 2023; FDA, 2026

Your vial

Does the vial look off: wrong color, cloudy, clumped, a mismatched lot number, or a label that's been covered?

If yes: Set it aside, keep the packaging, and see the bad batch page before you do anything else with it.

Reasons and sources

Lilly warns that illicit retatrutide may contain contaminants, impurities, or the wrong ingredients entirely. Most of those problems don't show, so a vial that looks wrong is the easy case to catch.

Source: Lilly, 2026

Has a lab with no ties to the vendor tested a vial from your own batch?

If no: Until then, you're trusting paperwork about someone else's sample. The vendor's COA covers the vial the lab tested, which isn't the one in your hand.

Reasons and sources

The harmonized USP sterility text says a passing result covers only the sample examined and can't by itself show that a batch is sterile.

Source: USP <71>

Sources for this page

  1. Corporate Registration

    National Association of Secretaries of State. Checked September 10, 2026. Archived copy.

    NASS links to each state and territory's business registration pages and corporate name databases through one drop-down menu.

  2. OpenCorporates

    OpenCorporates. Checked September 10, 2026. Archived copy.

    OpenCorporates says its company data comes direct from official primary sources across 140+ jurisdictions.

  3. ICANN Lookup

    Internet Corporation for Assigned Names and Numbers. Checked September 10, 2026. Archived copy.

    ICANN Lookup shows the current registration data for a domain name, pulled in real time from registries and registrars through RDAP.

  4. Domain Registration Data: Advanced Lookup Functionality Now Available

    Internet Corporation for Assigned Names and Numbers. Published August 2, 2021. Checked September 10, 2026. Archived copy.

    ICANN says it built its lookup tool as a free public service that shows public registration data, such as the date a domain name was registered.

  5. How to avoid an online shopping scam this holiday season

    Federal Trade Commission. Published November 25, 2025. Checked September 10, 2026. Archived copy.

    FTC warns that if a seller says you can only pay with a gift card, wire transfer, payment app, or cryptocurrency, it's probably a scam.

  6. Using Credit Cards and Disputing Charges

    Federal Trade Commission. Updated May 23, 2022. Checked September 10, 2026. Archived copy.

    FTC says a Fair Credit Billing Act dispute letter must reach the card issuer within 60 days after the first bill with the error, and federal law caps unauthorized charges at $50.

  7. What To Do if You Were Scammed

    Federal Trade Commission. Updated June 30, 2026. Checked September 10, 2026. Archived copy.

    FTC says cryptocurrency payments lack the legal protections of credit and debit cards, so money is hard to get back, and it takes scam reports at ReportFraud.ftc.gov.

  8. Online Shopping

    Federal Trade Commission. Updated May 1, 2023. Checked September 10, 2026. Archived copy.

    FTC says to search a company's name plus "complaint" or "scam," warns that some reviews are fake, and says never to pay sellers who insist on gift cards, wire transfers, payment apps, or crypto.

  9. FTC's Endorsement Guides: What People Are Asking

    Federal Trade Commission. Updated June 29, 2023. Checked September 10, 2026. Archived copy.

    FTC says an influencer's personal discount code probably conveys a relationship with the brand, and shoppers may not understand that "affiliate link" means the poster gets paid.

  10. Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials

    Federal Trade Commission. Published August 14, 2024. Checked September 10, 2026. Archived copy.

    The FTC's final rule, approved 5-0, bans fake reviews such as AI-generated ones, undisclosed insider reviews, and buying or selling fake social media followers or views.

  11. The Consumer Reviews and Testimonials Rule: Questions and Answers

    Federal Trade Commission. Published November 8, 2024. Checked September 10, 2026. Archived copy.

    FTC says its Rule on the Use of Consumer Reviews and Testimonials took effect October 21, 2024, and lets courts impose civil penalties for knowing violations.

  12. § 201.128 Meaning of “intended uses”.

    Office of the Federal Register (National Archives and Records Administration). Updated September 9, 2026. Checked September 10, 2026. Archived copy.

    FDA rules tie intended use to the objective intent of those who label a product, which labeling claims, advertising matter, or oral or written statements can show.

  13. Gram Peptides - 721806 - 03/31/2026

    U.S. Food and Drug Administration. Published March 31, 2026. Checked September 10, 2026. Archived copy.

    FDA found that the company's retatrutide and tirzepatide, labeled "Research Use Only," were drugs for human use, citing its own site claims about reducing body weight.

  14. Peptide Partners LLC - 735063 - 08/24/2026

    U.S. Food and Drug Administration. Published August 24, 2026. Checked September 10, 2026. Archived copy.

    FDA says the company's "research use only" products, including one sold as "GLP-3 Reta," are drugs for human use, and that selling bacteriostatic water provides the means to prepare an injectable drug.

  15. Royal Peptides LLC - 734884 - 08/24/2026

    U.S. Food and Drug Administration. Published August 24, 2026. Checked September 10, 2026. Archived copy.

    FDA says the company marketed bacteriostatic water alongside a "peptide guide" and "peptide calculator," which together provide the means to prepare an injectable drug.

  16. § 211.84 Testing and approval or rejection of components, drug product containers, and closures.

    Office of the Federal Register, National Archives and Records Administration. Checked September 10, 2026. Archived copy.

    FDA's drug GMP rule requires at least one identity test on each component and lets a maker rely on a supplier's report only if it runs a specific identity test and validates the supplier's results.

  17. Q7 Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients Guidance for Industry

    U.S. Food and Drug Administration. Checked September 10, 2026. Archived copy.

    ICH Q7 says a COA should list product name, batch, release and expiry or retest dates, each test's limits and numerical results, a dated quality signature, and the original maker's contact details.

  18. The peptide problem: Hype is outrunning the evidence

    The Conversation. Published May 6, 2026. Checked September 10, 2026. Archived copy.

    McMaster professor Stuart Phillips writes that the "third-party" labs issuing peptide purity certificates are often the vendors themselves, linking to a CBC Radio explainer.

  19. ISO/IEC 17025 — Testing and calibration laboratories

    International Organization for Standardization. Checked September 10, 2026. Archived copy.

    ISO says ISO/IEC 17025 enables laboratories to show they operate competently and generate valid results, and the current edition is ISO/IEC 17025:2017.

  20. Frequently Asked Questions

    American Association for Laboratory Accreditation. Checked September 10, 2026. Archived copy.

    A2LA says a scope of accreditation lists the specific tests a lab was found competent to perform, and capabilities not listed on the scope are not covered by its accreditation.

  21. Search A2LA Directory of Accredited Organizations

    American Association for Laboratory Accreditation. Checked September 10, 2026. Archived copy.

    A2LA's directory searches accredited organizations by name, certificate number, scope, or test method and links to suspended, withdrawn, and inactive certificates and false accreditation claims.

  22. Directory of Accredited Organizations

    ANSI National Accreditation Board. Checked September 10, 2026. Archived copy.

    ANAB's directory searches accredited organizations by keyword, company, or certificate number and filters by status, including active, suspended, and withdrawn.

  23. Search UKAS accredited organisations

    United Kingdom Accreditation Service. Checked September 10, 2026. Archived copy.

    UKAS lets anyone browse its directory of accredited organizations and search by type, name, region, or category.

  24. ILAC MRA Signatory Search

    International Laboratory Accreditation Cooperation. Checked September 10, 2026. Archived copy.

    ILAC's search finds accreditation bodies that signed the ILAC Mutual Recognition Arrangement, by economy and scope, and links to some of their online directories.

  25. False Claims of Accreditation

    International Accreditation Service, Inc.. Checked September 10, 2026. Archived copy.

    IAS names organizations that misuse its accreditation mark, including one issuing IAS-marked certificates without ever being accredited, and asks users to check its directory.

  26. Specifications: Test Procedures and Acceptance Criteria for New Drug Substances and New Drug Products: Chemical Substances Q6A

    International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. Published October 6, 1999. Checked September 10, 2026. Archived copy.

    ICH Q6A says identification solely by a single chromatographic retention time is not specific, and the guideline does not adequately cover higher molecular weight peptides.

  27. Reference Standards to Support Quality of Synthetic Peptide Therapeutics

    Springer Nature (Pharmaceutical Research). Published March 22, 2023. Checked September 10, 2026. Archived copy.

    The authors write that peptide identity is typically confirmed with several orthogonal methods, including HPLC retention time, NMR, and mass spectrometry, separate from impurity and content tests.

  28. Pyrogen and Endotoxins Testing: Questions and Answers

    U.S. Food and Drug Administration. Updated March 18, 2026. Checked September 10, 2026. Archived copy.

    FDA's March 2026 revised guidance says USP <85>, USP <161>, and AAMI ST72 recommend testing components and finished products for pyrogens and endotoxins.

  29. <85> Bacterial Endotoxins

    United States Pharmacopeial Convention. Published November 23, 2011. Checked September 10, 2026. Archived copy.

    USP says the Pharmacopeial Discussion Group approved the <85> Bacterial Endotoxins Test as a harmonized standard, official in USP since December 1, 2012.

  30. <71> Sterility Tests

    United States Pharmacopeial Convention. Checked September 10, 2026. Archived copy.

    The 2008 harmonized USP <71> text says its tests are not by themselves designed to ensure a batch is sterile, a pass covers only the sample examined, and incubation lasts at least 14 days.

  31. Counterfeit certificates and false claims of UKAS accreditation

    United Kingdom Accreditation Service. Checked September 10, 2026. Archived copy.

    UKAS warns of counterfeit certificates and organizations falsely claiming UKAS accreditation for management systems certification, and names the ones it knows about.

  32. Identify Real Lilly Medicine

    Eli Lilly and Company. Checked September 10, 2026. Archived copy.

    Lilly warns that illicit retatrutide, often sold under a "research use only" pretext, may contain harmful contaminants, impurities, or the wrong ingredients entirely.