Multiple instances of likely faked labels in PSA slabs

[pfm]

I put this together so that people don’t have to read though the other full thread to get the information.

Background

Yesterday, Reddit user u/Doemi-14 discovered a PSA slab on Fanatics Collects
that shared a cert number (65821932) with a card they owned. In other words, two different slabs with the same cert.

Both cards appear real, the PSA label looks legitimate but there are some inconsistencies with the plastic casing. The PSA cert page for the card shows no scan of the card, which is consistent with cards graded during that time period.

A discussion post on e4 was made where we worked though the inconsistencies: Fake slab on Fanatics ?!

The hypothesis

The PSA label has multiple security features that intentionally make it hard to replicate. However, in theory, a malicious party can only needs to fake the text on an existing label. It seems to be the case that a solvent was used to remove the text off a label and new text was printed on. A separate Reddit post supports this idea.

Given the ability to create a label with any text, a malicious party can take produce their own “PSA 10” label of a card, using a public serial number. So you can imagine someone taking a real PSA 9 copy of a card, changing the label then reslabbing it as a “PSA 10”. It also seems like the cert ranges with no scan on the PSA website may be targeted specifically.

How to spot one

There appear to be multiple tells, however there one that is pretty unambiguous that I originally had posted here: Fake slab on Fanatics ?! - #122 by pfm.

On the back of the label is a QR code. The QR code encodes a string of characters. For example, the real Dragonite card has this:

https://www.psacard.com/cert/65821932/

Whereas the alleged fake one on Fanatics looks like this:

https://www.psacard.com/cert/65821932/psa
ie. includes a /psa at the end, which is what to look for.

When you visit the webpage, the /psa is automatically added to the URL (which is probably why it ended up in the reprinted QR code). So you have to decode the QR code itself and see what the URL string is. You can use a website like this https://scanqr.org/

Note

I can’t guarantee every faked label ends in /psa and I can’t guarantee that all real cards do not have the /psa. However, multiple suspected slabs did have this signature in their QR code and I tested ~1300 randomly sampled PSA slabs looking for /psa. None had it, which indicates it’s a pretty clean test.

Here is a PDF of the cards I tested:

psa_qr_survey.pdf (7.2 MB)

Please feel free to post any more information or possible corrections below and I will update this post. Also if you come across slabs with /psa put them here so we can start putting together a list.

[expedition]

I would add that the process of removing the text from labels also causes the fugitive ink dots in the background to disappear. This does not mean that every label without dots is immediately a fake, we don’t know if it can happen through natural causes. But any label without dots in the background should be scrutinized.

Untampered left, tampered right. Check the whole label, sometimes dots are less visible in areas. On the fake labels they aren’t present anywhere on the front, nor back.

Untampered top, tampered bottom:

[pfm]

You should should a comparison pic if you have one

[ascendedbidoof]

Is the /psa at the end of the URL no longer a feasible way of verifying future fakes, since that can be removed when creating the QR codes put on fake labels?

[pfm]

Basically as soon as it was made public it’s been invalidated, correct. I wasn’t sure whether to keep it private or not but I think it’s fair for everyone to have access to the method so people don’t actively buy and sell suspected slabs unknowingly.

[mannynotfound]

Here’s ones ive found in fanatics weekly auctions so far

WA249 Lot: 18385F2

WA246 Lot: 16695

WA235 Lot: 13779

[tstark20]

Trying to fully understand the web page link situation.

Do we even know if the /psa links are official PSA pages, or perfectly recreated pages that are set up to mimic and link back to PSA proper? Or is it more so an issue of the reprinted QR code on the faked label simply adding on an extra string of characters?

[pfm]

PSA added the /psa to the URLs when cert numbers started conflicting with PSA DNA numbers, in order to differentiate the cert pages. Now, it gets appended automatically when you visit the page.

The QR code stores just the URL string. So presumably when the people who modified the label went to produce the QR code, they just copied the full URL not realizing they were picking up the additional prefix.

[Professor_Broke]

I hate everything about this.

[tstark20]

Got it, so essentially they’re the “same” link/page, but the original, authentic QR codes could only possibly contain the original string, and not the added prefix, which was added retroactively across the site.

[pfm]

When you make the QR code, you can stick any URL in there with whatever extra stuff you want to.

In theory, PSA could have started using the /psa URL after they made the switch on their site. But in the 1300 slabs I checked, they did not use it. In the pdf you can see some are https://www.psacard.com while some are http://psacard.com so there’s some variation even within real slabs. Regardless, they all link to the same page.

[tstark20]

This is making my stomach churn. Thanks for everything you’re doing.

The really unfortunate reality is that nobody is “safe” from this. Surely they were trial running these fakes on a wide variety of less expensive items, confirming their ability to get past authenticators before moving onto higher end items.

Can’t even really guess as to how long it’s been happening. Probably should just check everything.

[Will]

Here is how different strings show using the LC Gyarados 10 as an example. Hypothesis is label that pulls URL that ends in /psa is not authentic

[mannynotfound]

Here are the known ones from Fanatics buy it now / premier auctions:

PA Lot: 124F2

PA Lot: 142

PA Lot: 333

P322fee0f-ab36-4449-a004-e751eb7b3e10

Earliest one i’ve found seems to be the Mewtwo that showed up in Jul 20, 2026, then all the other ones are recently from October. Maybe they tested with a cheaper modern Mewtwo card before moving onto the vintage stuff.

[Bubblemewex]

I think it’s worth noting that hyphen spacing is not consistent on these

[mannynotfound]

Some from Alt, not sure if the Umbreon has been posted:

aab0feec-ba72-4ef0-91de-6e6ecfd5c1dd

71a31e92-d8e4-4f0f-b9b4-31b9b503eb40

[pikachutcg]

The tell I’ve been using so far is the placement of the PSA text on the backside bottom-right corner, but viewing it from the front. This stands out like a sore thumb when compared with genuine slabs, as the text is in the wrong position. The same misplaced text appears on all the fake slabs flagged so far with /psa in the QR code.

If you want to scout manually, zoom in on your browser by holding Ctrl and scrolling up with your mouse wheel until only 1–2 cards are visible on the screen. Then scroll down through the listings to inspect them more easily.

I have yet to find a genuine slab with the same text size/placement as the fakes that have been flagged.

[Nrx]

This one from ALT also, but they already remove it :

Thx @pikachutcg for the back

[pikachutcg]

The ebay Gyarados from the other thread :

@Nrx

This one from ALT also, but they already remove it :

I saved all of these earlier in case they started removing them, Here is the backside to the mew you posted

[packyman]

Are all the examples from pre-PSA including a scan publicly? Is there a chance PSA was recording scans of earlier certs and someone internally got ahold of them?