Manufacturing Notes · Component sourcing
BOM Sourcing Risk: How Counterfeits Enter a Build
Counterfeit parts almost never arrive through a dramatic channel. They arrive because a line went short, a broker answered faster than the authorised distributor, and nobody asked for the paperwork that proves where the parts came from. This note sets out the four patterns we look for and the evidence rules we buy under.
Published 29 January 2026 · updated 12 February 2026 · 10 min read · Priya Raman, Sourcing Manager
The five risk patterns
Five ways a bad part gets into a good BOM
These are the five failure patterns behind almost every sourcing incident we have investigated. They run in a single column, ordered from the cheapest to prevent to the most expensive to discover.
Risk 01
Grey-market substitution under schedule pressure
A line is short, the authorised lead time is 14 weeks and a broker offers stock in three days. Re-marked and used parts enter the market exactly where demand is urgent, and the price gap is the tell: a genuine part priced 40% below the authorised channel is not a bargain, it is a different part. McKinsey reports 73% of firms now dual-sourcing, which raises the number of channels a buyer has to police rather than lowering it.
Risk 02
Traceability gaps and mixed lots
Parts turn up in unlabelled bags, with reels that carry two date codes for one part number, or with a quantity that does not divide into standard reel sizes. Any of those signals means the chain of custody broke somewhere. In our own audits the commonest single defect is a false or altered date code, followed by short counts in broker-sourced reels.
Risk 03
Grade and temperature-range mismatch
The part number is right, the suffix is not. An AEC-Q100 Grade 0 part is rated from minus 40 to plus 150 degrees C, and an off-grade part with the same base number will pass a functional test at room temperature and fail in the field. Grade substitutions are the quietest form of counterfeiting because nothing about the assembly looks wrong.
Risk 04
Storage and moisture damage in transit
Parts bought through an unknown channel may have been stored outside a dry cabinet and baked twice. Moisture-sensitive devices absorb water, then crack or delaminate in the reflow oven at a 217 degrees C SAC305 liquidus, which produces failures that AOI will see as solder defects rather than as a parts problem.
Risk 05
Paperwork that does not survive a spot check
A Certificate of Conformity that names no lot code, a CoC from a company that is not the manufacturer, a date code printed in the wrong font. Incoming inspection checks the document against the reel, then the reel against the BOM, then the BOM against the approved vendor list. A single mismatch stops the lot, which is the point of having the check.
Risk scan output
What the BOM scan flags before a purchase order
Every BOM is machine-checked at quotation and again at material release. Four classes of line stop the release until someone with authority answers them; the block below is the shape of that output.
scan lines=184 policy=authorized-first source_register=1124_suppliers line U14 MPN LTC3411EMS pkg MSOP-10 FLAG lifecycle=obsolete reason last-time-buy passed 11 months ago; broker stock is re-marked action hold PO; request alternate or bridge-buy decision line C88 MPN GRM188R71C104KA01D pkg 0603 FLAG mixed date codes reason reels 1419 and 2312 quoted as one lot, 4,000 pcs short total action split lots, recount, reject broker balance line U31 MPN TPS7B6933QDBVRQ1 pkg SOT-23-5 FLAG grade mismatch reason Q1 suffix quoted by an unauthorised source; Grade 0 required action buy authorised or hold; off-grade part cannot ship line J2 MPN 1-1734592-2 pkg header FLAG evidence gap reason no CoC on file; supplier has no traceability declaration action quarantine pending CoC or independent test result 4 flagged of 184 lines; release blocked until each flag is answered
Flags are advisory to the buyer and binding on our own purchase orders: a line in this state is not bought until the customer or the programme owner answers it in writing.
Buying rules
The supplier tiers we buy under, and the evidence each one owes
Ten buying routes in the order they are preferred, with the evidence required and what happens when a route fails. The policy is authorised-first: a cheaper route never outranks a traceable one on its own.
| Tier | Source route | Evidence required | Decision |
|---|---|---|---|
| Tier 1 | Manufacturer direct | CoC naming the lot code and the date code | Preferred; no query |
| Tier 1 | Authorised distributor | CoC plus the distributor's own traceability declaration | Preferred; no query |
| Tier 1 | Franchised distributor | CoC and a documented chain back to the manufacturer | Accepted |
| Tier 2 | Manufacturer excess through an authorised channel | CoC, original packaging and a sealed dry-pack history | Accepted with a date-code check |
| Tier 2 | OEM aftermarket programme | Programme letter and lot traceability | Accepted for legacy and defence |
| Tier 3 | Broker with full traceability | CoC, chain of custody and independent test to AS6081 | Customer approval required in writing |
| Tier 3 | Broker without traceability | None available on request | Rejected; not bought at any price |
| Tier 3 | Open market and online marketplaces | Unverifiable seller identity | Rejected outright |
| Tier 4 | Customer-supplied free issue | Incoming IQC plus a written acceptance of the source | Accepted with a documented disclaimer |
| Tier 4 | Customer-named source we have not audited | Supplier declaration and a first-article build before volume | Accepted after one pilot lot |
AS6081 is the counterfeit-avoidance standard for independent distributors; AS5553 covers the same ground for the buyer's own process. Section 301 adds 25% to many China-origin component lines, which is one reason the cheapest quote on an urgent shortage is rarely the cheapest part.
Incoming inspection
How the chain is checked at the door
A traceability claim is only worth what the receiving check can verify. Incoming inspection matches document to reel, reel to BOM and BOM to the approved vendor list; anything that fails one of those three matches is quarantined rather than argued about.
Programmes under IATF 16949 retain these records for 15 years; all other programmes retain them for at least 7 years. Deloitte finds 57% of China-based industrial manufacturers diversifying their footprint, so the sourcing map behind a single BOM changes faster than the BOM revision does.
Buyer questions
What sourcing teams ask us next
A 180-line BOM is scanned in about two hours and the result comes back with the quotation, not after it. The scan covers lifecycle status, authorised-channel availability, second-source options and any date-code or packaging constraint we already know about from the supplier register.
Yes, with three conditions in writing: a named broker we can identify, full chain-of-custody documents, and independent test to AS6081 before the parts touch a line. Customers who need this route usually need it for a legacy programme, and the honest answer is that it costs more per part than an authorised shortage buy and takes longer.
It is quarantined in a labelled area, photographed and reported to the customer with the reason for rejection. Nothing is returned to the supplier until the customer has decided, and the supplier is flagged in our register so the same route cannot be used on another programme without a new approval.
