JennaRN said:

Prices dramatically below market are the strongest single signal, and the reason is arithmetic rather than suspicion.

I disagree that testing history is decisive. It tells you what a supplier did when they were being watched. Continuity of behaviour under stress — a late shipment, a failed test, a complaint — is more predictive than any run of good results.

HPLC_Greg said:

Eight months with one supplier, then a change in how they communicate that I noticed before I noticed anything about the product.

Shipping damage protocol for vendor vetting orders: if your package arrives with visible damage, temperature excursion, or broken vials:

• Photograph EVERYTHING before discarding packaging
• Note the temperature of the cold pack (liquid = possibly too warm)
• Contact the vendor within 24 hours with photos
• Request a replacement shipment or refund
• Do NOT use potentially compromised medication

Reputable vendors will replace damaged shipments without argument. If they push back, that's a red flag about the vendor.

LabKate said:

I disagree that testing history is decisive.

Adding the part of the answer the thread has not reached. Whatever the answer turns out to be, the method for getting there is the same: state the assumption, do the arithmetic in public, and invite the correction. That is slower than asserting, and it is the only version that survives being wrong.

A narrower follow-up, since the general answer is now clear:

What a vetting checklist should actually contain, as opposed to a list of things that are easy to fake?

Closing the loop on my own question.

Went back through my own correspondence with an earlier supplier and the warning signs were all there in the replies, weeks before the quality changed. I was reading the product and not the behaviour.