How to Spot a Counterfeit Vape Cart

Someone hands you a cart. The box is glossy, there’s a hologram in the corner, a QR code on the back, and the strain name matches something you’ve heard of. You have no way to know whether the oil inside came from a licensed extraction lab or someone’s kitchen.

That’s the actual problem. Not whether counterfeits exist — they do, in volume — but that the fake and the real thing are built to be indistinguishable at arm’s length, because packaging is the easiest part to copy.

Here’s a five-layer check. No layer is decisive alone. Together they get you somewhere useful, and the last one matters more than the other four combined.

Why this isn’t hypothetical

In mid-2019, hospitals across the US started seeing young, previously healthy people arrive in respiratory failure. The condition was named EVALI — e-cigarette, or vaping, product use-associated lung injury. As of 7 January 2020, the CDC had logged 2,558 hospitalised non-fatal cases and 60 deaths (Werner et al., 2020). In the first large clinical series — 98 patients across Illinois and Wisconsin — 95% were hospitalised, 26% needed intubation and mechanical ventilation, and two died. Median age: 21 (Layden et al., 2020).

The cause was an additive. CDC researchers analysed bronchoalveolar-lavage fluid — the wash from deep inside the lungs — from 51 EVALI patients across 16 states and from 99 healthy participants. Vitamin E acetate turned up in 48 of the 51 patients (94%) and in none of the comparison group (Blount et al., 2020). That’s an unusually clean signal for an outbreak investigation.

Vitamin E acetate is a thick oil used in skin products and supplements. It’s harmless to swallow. It is not harmless to heat to vaping temperatures and inhale: a Dublin chemistry group showed that pyrolysing it at vaping temperatures can release ketene, an extremely toxic gas, plus carcinogenic alkenes and benzene (Wu and O’Shea, 2020). That’s a laboratory mechanism, not proof of what happened in any individual’s lungs, and CDC has always said vitamin E acetate is strongly linked to the outbreak without ruling out other contributors. The direction of the evidence isn’t ambiguous, though.

Why was it in the carts? It’s cheap, and it makes thin oil look thick. Diluted distillate stretched with a thickener passes the eyeball test consumers had been taught to use.

Layer 1: Packaging — the weakest layer, and the one everyone trusts

The structural fact: empty branded packaging for essentially every recognisable vape brand is manufactured and sold in bulk. Boxes, inserts, foil seals, holograms, hardware — sold as a kit, to anyone. A counterfeiter’s job isn’t to imitate the packaging. It’s to buy it and fill it.

The documented case is “Dank Vapes.” In an Illinois case-control analysis, EVALI patients had about eight and a half times the odds of reporting Dank Vapes use versus other people who vaped THC and stayed well (adjusted odds ratio 8.5, 95% CI 3.8–19.0). The authors describe it plainly as “a class of largely counterfeit THC-containing products” (Navon et al., 2019). It had a logo, flavour names, packaging you’d recognise across a room. There was no company. Wisconsin investigators later traced three social clusters of EVALI patients who’d all bought cartridges from illicit dealers, several labelled Dank Vapes; vitamin E acetate was in all five cartridges they could test (Pray et al., 2020).

What packaging can still tell you:

• Fine print, not the logo. The logo is always right. Warning statements, addresses and ingredient lists are where misspellings show up, because counterfeit inserts are built from scraped artwork.
• Regulatory marks. Licensed markets mandate a universal THC symbol, licence number, net weight, batch identifier and test date. Counterfeiters copying a national “brand” often don’t get state-specific compliance right.
• A batch number that goes somewhere. It’s only useful if it matches something.

On holograms and scratch-off codes. Both are partial solutions. A hologram is a manufacturing hurdle, not a proof — the foil is itself a commodity. Scratch-off codes are better, since a genuine code should be single-use and validate against the brand’s database. But codes get harvested from real product and reprinted, and cloned verification sites get set up on lookalike domains so the counterfeit’s QR code returns a cheerful “authentic.”

The rule: never let the package tell you where to verify it. Look the brand up independently, go to their real site, enter the code there. If the QR code lands you on a domain you’ve never heard of, you’ve learned something.

Layer 2: The COA — the strongest single document, read properly

A certificate of analysis is a lab’s report on a specific batch — the closest thing to evidence you’ll hold. Our complete COA guide walks the whole document; here’s the counterfeit-specific version.

The batch match is the whole game. Find the batch or lot number printed on the package. Find it on the COA. They must be the same string. That single check defeats the most common fraud — the recycled certificate, where one genuine report is attached to thousands of unrelated units. If the package names no batch at all, the COA can’t be tied to what you’re holding, and it’s decoration.

What a genuine report contains:

Element	What you should see
Laboratory identity	Name, address, state licence or accreditation number (ISO/IEC 17025 is standard)
Sample identity	Sample ID, matrix type, batch/lot number, client name
Dates	Date received and date tested
Cannabinoid panel	Individual cannabinoids by weight percent, limits of detection stated
Contaminant panels	Pesticides, residual solvents, heavy metals, microbials, mycotoxins — each pass/fail against a defined limit
Methods and sign-off	Analytical method per panel, plus a named analyst or lab director

Signs of a recycled or fabricated COA, roughly in order of usefulness:

1. Batch mismatch, or no batch number at all.
2. Potency only. A compliance COA includes contaminant panels; a single-page potency sheet is an R&D test or an edit.
3. Test date long predates the product. A certificate from two years ago isn’t about fresh inventory.
4. Numbers that don’t reconcile. Percentages summing past 100, or a “total cannabinoids” figure that doesn’t match its own rows, means the document was edited rather than generated.
5. No lab licence number, or a lab that doesn’t exist. Search the name against your state’s lookup.
6. A flattened image with no metadata. Real portals emit PDFs with selectable text. A screenshot of a COA is a screenshot.

Check where the file lives, too: a genuine COA sits on the brand’s own domain or the lab’s portal, not a file-sharing link.

The honest limitation. A matching COA proves the batch was tested for what your state requires — not for everything. Diluents and thickeners aren’t on every mandatory panel, and vitamin E acetate became a required screen only in some jurisdictions, only after the outbreak. Standards are inconsistent enough that we wrote a whole piece on where they fail, plus one on why dispensary label numbers are so often wrong. A COA is the best evidence available. It isn’t a guarantee.

Layer 3: The hardware

Counterfeiters buy generic cartridge hardware in bulk, and that’s where cost gets cut hardest.

• Tank material. Glass or ceramic versus plastic. Held to the light, glass has a crisper edge and a colder feel; plastic looks milky and scratches easily.
• Wick and coil. Quality carts use ceramic cores. Cheap ones wrap a cotton or silica wick around a wire coil, often visible through the tank as a fibrous white sleeve. Cotton scorches and tastes like burnt string.
• Threading and seals. Cross-threading, wobble on the battery, a mouthpiece that twists loose, or oil weeping around the base ring before first use.
• Airflow. A badly drilled airflow hole forces heavy draws, which pushes people to raise voltage, which makes overheating worse.

This isn’t quality-snobbery. A Canadian government study of legal cannabis vape products found metal particles — aluminium, cobalt, chromium, copper, nickel, tin, zinc — in the vape liquids, and cobalt, chromium, nickel, lead, tin and zinc in the resulting aerosol. Electron microscopy on an unused device showed cracking on the connector pin, and the particles’ composition matched the cartridge’s own metal components (Gajdosechova et al., 2025). If licensed products leach metals from their hardware, hardware built to no spec is not a smaller problem. It’s why the cart-versus-disposable decision and vaporizer selection deserve more thought than “whatever’s on the counter.”

Layer 4: The oil itself

This is the layer people trust most and it deserves the least.

The bubble test. Turn the cart upside down and watch the air bubble travel. A slow, syrupy crawl means high viscosity, and vitamin E acetate is extremely viscous — that’s where the test comes from. But viscosity also rises with cannabinoid content and falls with temperature and terpene load. A live-resin cart in a cold room and a cut distillate cart can look alike. One weak input, compared at room temperature, never a verdict.

Colour. Genuine concentrate runs pale straw through gold to deep amber depending on method and age. The extremes inform: near-black suggests oxidation or unrefined crude; water-clear oil that is also very thick deserves a second look, since that’s what a heavy diluent load produces. Our rosin versus distillate and live resin versus live rosin pieces cover what each style normally looks like.

Separation. Real oil is homogeneous. Visible layering or a boundary between two phases means something immiscible was mixed in.

Flavour. Trust this more than the visual checks — it’s harder to fake. Metallic or “penny” taste, a solvent note, sickly-sweet plastic, or harsh throat burn at low voltage on the first pull all mean stop.

The most sobering finding here comes from New York State’s Wadsworth Center, which analysed 38 samples from cartridges recovered from the first 10 New York EVALI cases. The illicit fluids had relatively low cannabinoid content, sometimes with unusual delta-9 to delta-8 THC ratios, sometimes contained pesticides, and 64% of the cannabinoid-containing fluids contained vitamin E acetate. The team also tested six commercial “cannabis oil diluent/thickener” products sold openly: three were more than 95% vitamin E acetate, two mostly squalane, one mostly bisabolol (Duffy et al., 2020).

Read that again. The counterfeits weren’t unusually strong. They were unusually weak, stretched with a thickener chosen to hide the dilution. THC percentage was already a poor guide; on the illicit market it can be actively inverted. Those delta-8 ratios also point at delta-8 versus delta-9 chemistry and the hemp-derived loophole — a category now sending children to emergency departments and reaching minors at measurable rates. Acetate esters behave badly under heat generally, the subject of our piece on why vaping THC-O releases ketene.

Layer 5: Where you bought it — the one that matters

Everything above is pattern-matching against an adversary who controls the patterns. Provenance is different: it’s the one variable a counterfeiter can’t copy.

The Illinois case-control study gives the clearest number. Compared with adults who used THC vape products and didn’t get ill, EVALI patients had roughly nine times the odds of having obtained their products from informal sources — a dealer, off the street, or a friend (adjusted odds ratio 9.2, 95% CI 2.2–39.4). They also had higher odds of exclusive THC-product use and of frequent use, more than five times a day (Navon et al., 2019).

That is the largest effect in the literature on this question, and it’s the whole recommendation in one sentence: buy vape products from a licensed dispensary in a regulated market. Regulated supply gives you chain of custody, mandatory batch testing, a licence number you can look up, a business with something to lose, and a recall mechanism. None of that exists in a backpack.

Practically: our guides to choosing a dispensary and a first visit cover the habit; state-by-state legality and the national picture tell you what’s available near you. Using a delivery service? Confirm it’s licensed — delivery is where legal and grey-market operations look most alike from outside.

The limits, honestly: the regulated market is not a clean room. Testing standards vary by state, budtender knowledge is thinner than most people assume, and licensed hardware has its own metals problem. “Much safer” is a real claim. “Risk-free” isn’t one anyone should make.

The quick reference

Signal	What it suggests	Weight
Bought from an unlicensed source	Highest-risk factor in the published data	Decisive
Batch number on package matches COA	Product is tied to a real test	Very high
COA has contaminant panels, licensed lab, recent date	Genuine compliance testing	Very high
QR code lands on an unfamiliar domain	Possible cloned verification site	High
Misspellings in fine print, garbled regulatory text	Scraped or invented packaging	High
Metallic, chemical or plastic taste on first pull	Hardware or oil contamination	High
Cotton wick, plastic tank, leaking seals	Bottom-tier generic hardware	Moderate
Oil separation or layering	Something immiscible was added	Moderate
Very slow bubble at room temperature	High viscosity — diluent, or just potency	Low alone
Hologram present	Almost nothing	Very low

If you think you already have one

Stop using it. There’s no dose that’s safely “testing it out,” and no home method that will tell you what’s in it.

If you’ve used an unverified cart and develop symptoms, get medical care. In the first large EVALI series, 97% of patients had respiratory symptoms, 77% gastrointestinal symptoms, and 100% constitutional symptoms such as fever, fatigue and weight loss; every patient had bilateral infiltrates on chest imaging (Layden et al., 2020). Tell the clinician you’ve been vaping, and what. That sentence changes the differential diagnosis, and clinicians can’t act on information they don’t have.

Keep the cartridge and packaging rather than binning them. Health departments only reconstructed 2019 because patients handed over their hardware.

What none of this tells you

Suppose you do everything right: licensed dispensary, matching batch number, clean COA, good hardware, oil that tastes like it should. You’ve established the product is what it says it is.

You still don’t know how it will affect you. The strain name on a genuine cart is a marketing label on a lineage crossed, renamed and re-crossed until two products sharing a name can have materially different chemistry. What predicts your experience is composition — cannabinoid ratio and terpene profile — meeting your physiology. Myrcene and linalool pull differently than limonene and terpinolene; caryophyllene behaves unlike any of them; bisabolol appears in this article as both a terpene and, awkwardly, a diluent.

That’s why we group products into High Families by chemistry — the relax profile, the uplift profile, or something effect-specific like calm — rather than by name. Two carts labelled Blue Dream can behave differently; a Gelato and a Wedding Cake with near-identical terpene profiles can behave alike. A Sour Diesel, an OG Kush and a Jack Herer cart are three chemistries, not three moods — the same logic as finding your ideal high without strain names and keeping a session journal.

Authentication tells you the product is real. Only your own logged responses tell you whether it’s right for you — which is exactly what the High IQ app is built to track.

FAQ

Can a counterfeit cart be dangerous without vitamin E acetate? Yes. The New York analysis found pesticides in some illicit cartridge fluids alongside the diluents (Duffy et al., 2020), and unregulated hardware adds its own metal exposure. Vitamin E acetate was the agent in 2019, not the only thing that can go wrong in an untested product.

Is the bubble test reliable? Not alone. It measures viscosity, which varies with cannabinoid content, terpene content, extraction method and temperature as well as with diluents. Use it as a tiebreaker after source and COA, never as your primary test.

What if the QR code works and shows a COA? Check two more things: does the batch number match the one printed on your package, and is it hosted on the brand’s or the lab’s own domain? A working QR code returning a mismatched certificate is a classic counterfeit signature.

Are disposables safer because they’re sealed? No. Sealing is a manufacturing choice, not an authenticity guarantee — counterfeit all-in-ones exist too. The format comparison turns on cost, control and waste, not counterfeit risk.

Does buying legally eliminate the risk? It substantially reduces it — informal sourcing carried roughly nine times the odds in the Illinois analysis (Navon et al., 2019) — but doesn’t zero it. Legal products still carry hardware-derived metals (Gajdosechova et al., 2025), and testing rules differ by state. For broader context, see cannabis and lung health.

Sources

• Blount BC, Karwowski MP, Shields PG, et al. Vitamin E Acetate in Bronchoalveolar-Lavage Fluid Associated with EVALI. New England Journal of Medicine 2020;382:697–705. doi:10.1056/NEJMoa1916433
• Duffy B, Li L, Lu S, et al. Analysis of Cannabinoid-Containing Fluids in Illicit Vaping Cartridges Recovered from Pulmonary Injury Patients: Identification of Vitamin E Acetate as a Major Diluent. Toxics 2020;8(1):8. doi:10.3390/toxics8010008
• Gajdosechova Z, Marleau-Gillette J, Polivchuk M, et al. Tracking metal presence in cannabis vaping products from source to inhalation. Scientific Reports 2025;15:31939. doi:10.1038/s41598-025-17004-2
• Krishnasamy VP, Hallowell BD, Ko JY, et al. Update: Characteristics of a Nationwide Outbreak of E-cigarette, or Vaping, Product Use-Associated Lung Injury — United States, August 2019–January 2020. MMWR Morbidity and Mortality Weekly Report 2020;69(3):90–94. doi:10.15585/mmwr.mm6903e2
• Layden JE, Ghinai I, Pray I, et al. Pulmonary Illness Related to E-Cigarette Use in Illinois and Wisconsin — Final Report. New England Journal of Medicine 2020;382:903–916. doi:10.1056/NEJMoa1911614
• Navon L, Jones CM, Ghinai I, et al. Risk Factors for E-Cigarette, or Vaping, Product Use-Associated Lung Injury (EVALI) Among Adults Who Use E-Cigarette, or Vaping, Products — Illinois, July–October 2019. MMWR Morbidity and Mortality Weekly Report 2019;68(45):1034–1039. doi:10.15585/mmwr.mm6845e1
• Pray IW, Atti SK, Tomasallo C, Meiman JG. E-cigarette, or Vaping, Product Use-Associated Lung Injury Among Clusters of Patients Reporting Shared Product Use — Wisconsin, 2019. MMWR Morbidity and Mortality Weekly Report 2020;69(9):236–240. doi:10.15585/mmwr.mm6909a4
• Werner AK, Koumans EH, Chatham-Stephens K, et al. Hospitalizations and Deaths Associated with EVALI. New England Journal of Medicine 2020;382:1589–1598. doi:10.1056/NEJMoa1915314
• Wu D, O’Shea DF. Potential for release of pulmonary toxic ketene from vaping pyrolysis of vitamin E acetate. Proceedings of the National Academy of Sciences 2020;117:6349–6355. doi:10.1073/pnas.1920925117