Almost everyone has had the moment. You’ve found a supplier with great prices, an online store you’ve never heard of, a job offer that landed out of nowhere, a new client who wants to move fast, and something nags at you. Is this real? Am I about to be scammed?
You’re not being paranoid at all, you’re being perfectly normal. A 2026 survey found that 97% of people have at some point worried that the business they’d come across online wasn’t actually real and that worry is absolutely justified. The FTC reported that people lost a record $15.9bn to scams in 2025 and fake/impersonated businesses are a significant contributor to that total. The good news is that verification is far easier than most people realise and the vast majority of the fakes are actually quite sloppy once you know what to look for. This guide takes you through the scams to be on the lookout for, the checks that will catch them, how verification varies by country and by industry and where the simple checks ultimately fall down.
One idea runs through all of it. There are really two layers to checking a company. Surface checks tell you whether a business looks real and exists on paper, and they catch the lazy scams in minutes. Depth checks tell you whether it’s actually legitimate and safe to deal with, and they catch the ones that look perfect. A good scam sails through the surface checks. “Looks legit” and “is legit” are not the same thing.
What does it mean for a business to be legitimate?
Before checking one, it helps to be clear about what “legitimate” actually means, because it’s more than most people assume. A legitimate business satisfies four things at once, and a scam usually fakes the first while failing the rest.
It legally exists and is properly registered and, where required, licensed. It genuinely operates, with real products, services, and activity behind the name, rather than being a dormant shell. It’s honestly run, meaning it does what it says and is controlled by the people it claims, not a hidden party. And it’s authentic, its own business rather than an impersonation of someone else’s. Registration gets you only the first of those. A company can be perfectly registered and still be a shell, a front, or an outright fraud, which is exactly why confirming a company exists is the start of checking it, not the end.
Do you need to check a company, and why?
More people need to do this than realise it, because the risk isn’t limited to big business deals. A consumer buying from an unfamiliar online store risks paying for goods that never arrive. A job seeker risks a fake recruiter harvesting their personal details or an upfront “fee.” A freelancer risks a client who doesn’t exist or never intends to pay. And any business taking on a supplier, customer, seller, or partner risks fraud, non-delivery, sanctions exposure, and the reputational damage of being tied to a bad actor.
The common thread is a very simple asymmetry. A basic check takes a few minutes. The scam it stops can cost you money, data, time, your reputation and for a regulated business can cost you a lot in the way of legal exposure. It’s not about distrusting everyone. It’s about spending a little bit of effort up front to avoid a lot of pain later. The more that is at stake in the relationship the more that upfront effort is worth.
The most common business scams and types of fraud
It’s easier to spot a fake when you know the shapes they come in. Most business scams are variations on a handful of recurring schemes:
- Fake online stores. Convincing shops that take payment and never ship, often built fast on a new domain and gone within weeks.
- Impersonation and phishing. Scammers posing as a real, trusted company or brand to trick customers into paying them or handing over details.
- Fake invoices and business email compromise. Bogus bills, or emails posing as a supplier or executive, redirecting a real payment to a fraudster’s account.
- Advance-fee fraud. A demand to pay something now, a fee, a deposit, a tax, to unlock a much larger payout or opportunity that never materialises.
- Fake job and recruitment scams. Non-existent roles used to collect personal data, upfront payments, or free “training.”
- Investment and Ponzi schemes. Fake or hollow companies promising unrealistic returns, often with slick branding and fabricated track records.
- Supplier and non-delivery fraud. A business-to-business version of the fake store: take a deposit for goods or services, then disappear.
- Shell companies and fronts. Properly registered entities with a clean surface, used to hide who’s really behind an operation or to launder money.
The techniques evolve, and AI has made convincing fakes cheaper than ever, but the underlying moves are old. Learn the shapes and the specific con matters less than the pattern you recognise.
The tactics scammers rely on
Beneath the specific schemes sits a smaller set of psychological tactics, and these are often the fastest way to catch a scam, because they work even when the fraudster has no real company at all.
Urgency is the big one (limited time offer, a client who absolutely needs it sorted right now, an account that will be ‘suspended’ if you don’t act immediately). The urgency is there on purpose as thinking would be the giveaway. Impersonation and false authority follow (you’re being told you’re speaking to a well known brand, a bank, a regulator or a senior colleague) to steal the trust. The offer is always too good to be true. You’ll often get unusual, untraceable payment requests (by wire, crypto or gift card). And of course there’s the emotional manipulation (excitement at the prospect of an opportunity or fear of a consequence). A legitimate business is rarely going to be in a state of panic for you to bypass your own due diligence. If they are, that’s the red flag.
Step one: start with the official record
Now the checks themselves. The single most useful free one is also the one people tend to overlook: look the company up in the official business register for the country it claims to be operating in. Every country has one and they’re all free to use. In the UK it’s Companies House, in the US it’s the Secretary of State register for the relevant state and for a quick international view you can use an aggregator such as OpenCorporates which pulls together company data from all over the world.
What you’re looking for is simple. Does the company legally exist under the name it’s using? Is it currently active, rather than dissolved or dormant? When was it registered, and does that fit the story? A business boasting of twenty years in the trade that was incorporated three months ago is telling you something. So is a registered address that turns out to be a mailbox shared with hundreds of other companies. A company that isn’t in the register at all, or whose details don’t match what it told you, has already failed the easiest test there is, and this one check alone filters out a surprising share of outright fakes.
Step two: check the website and the domain
A professionally looking website costs almost nothing and tells you almost nothing, so look past the design to a few harder signals.
Check the age of the domain. A simple WHOIS lookup (free on loads of sites) will tell you when it was registered and a brand new domain behind a company that claims to be established is a massive red flag. Make sure the site has a valid HTTPS certificate (the padlock in the browser doesn’t mean the business is legitimate, just that the connection is encrypted). Look for a real physical address and a working telephone number (not just a contact form) and verify those details against the company register. Have a look at the content too: generic descriptions, stock photos presented as the team, no named people at all and a rather clunky style on a site that’s trying to come across as a sophisticated international business are all things to be suspicious of. The design is the easiest thing to faked, the detail is where it’s harder.
Step three: search their reputation, sceptically
What others say about a company is useful, as long as you remember that reviews are gamed in both directions, with fake five-star ratings propping up scams and planted one-star reviews sometimes attacking honest rivals. So read for patterns rather than individual reviews.
Search the company name with words like scam, complaint and fraud and see what comes up. Check with a complaints body (Better Business Bureau or equivalent in your country). See if the picture is consistent across the various independent sources as a company with a real track record will have a real track record, whereas a fake one will either have nothing to show or a very suspiciously uniform wall of praise all in the space of a single week. Of course bear in mind the context of the wider picture with the FBI’s cybercrime statistics which show the sheer volume of fraud which is now conducted via legitimate looking but entirely fake online operations. The complete absence of any trace at all is in itself telling.
Step four: check the people, not just the company
Here’s where the easy checks stop and the real ones begin (and where most people simply don’t look). A company can pass all of the above (valid registration, clean website, good reviews etc) and still be a problem as the risk is often not with the company per se but with the people who run it.
So look at the humans. Search the founders and directors by name. Have they run businesses that collapsed, been disqualified as directors, or left a trail of adverse media and lawsuits behind them? Are the people actually in control the ones the website implies, or is the real owner someone kept carefully out of view behind a nominee or a holding company? This is the check that catches the sophisticated fake, the one that took the trouble to look legitimate, because a polished front is easy to build and a clean set of people is not. A company is only ever as trustworthy as the people who own and run it, and they’re the thing a scammer works hardest to keep you from seeing.
Beyond the basics: advanced checks
For anything high stakes a few more in-depth checks will distinguish real effort from a cursory glance. Those are the ones that will pick out the fakes that have been built well enough to pass all the previous checks.
- Trace beneficial ownership. Follow the ownership through any holding companies and nominees to the real people who ultimately control the business.
- Screen against sanctions and PEP lists. Check the company and its owners against international sanctions and politically exposed person data, because transacting with a sanctioned party is a serious problem even if you didn’t know.
- Search adverse media properly. Look for negative news about the company and its people, including in other languages and jurisdictions, not just the first page of an English search.
- Check litigation and regulatory history. A pattern of lawsuits or a regulator’s action tells you how a business behaves when things go wrong.
- Cross-reference multiple sources. No single register or search is complete, so corroborate what you find rather than trusting one source.
Individually, each is a step past what most people bother with. Together, they’re the difference between confirming a company exists and actually knowing who you’re dealing with.
How to verify companies by country
One thing that people often get wrong is that company verification works the same in all jurisdictions. It doesn’t. There is no single global register and the ‘official’ source you check will vary depending on where the company is actually located.
In the US there’s no national business register. Companies are registered at the state level so you check with the Secretary of State for that state. Public companies file with the SEC’s EDGAR database. The UK is much simpler and better with Companies House which is free, centralised and actually useful. Across the EU it’s a patchwork with each country maintaining its own register, quality and level of access varies and a 2022 court ruling has effectively closed off access to beneficial ownership data. Elsewhere the situation ranges from excellent (with fully open digital registers) to effectively black. For a cross border check you can use the aggregators such as OpenCorporates which pull together a number of the national registers into a single search. The rule of thumb is always to check a company against the official register for its own jurisdiction and to treat the lack of a reliable register as a red flag in itself.
Industry-specific verification
Beyond the universal checks, some sectors demand extra verification, usually around licensing and regulatory standing. A few examples:
- Financial services: make sure the firm is authorised by the relevant regulator and check that regulator’s register and warning lists as unauthorised “financial” firms are a very common scam.
- Crypto and digital assets: check the registration or licensing status and any regulator warnings as the space is populated by both legitimate businesses and a lot of fast-moving fraud.
- Healthcare, construction and the trades: check professional licences, accreditation, insurance and bonding to separate the legitimate professionals from the charlatans.
- E-commerce and marketplaces: for sellers and suppliers, check for counterfeit history and confirm the business behind the storefront, not just the storefront.
The core checks never change, confirm the entity, the people, and the record, but each regulated sector adds its own licence to verify, and in those sectors an unlicensed operator is a red flag on its own.
The warning signs, in one place
Pull it all together and these are the red flags you should commit to memory. Any one of them can be explained away; it’s when several of them occur together that you’re rarely going to get an innocent explanation. The skill isn’t in spotting a single red flag, it’s in recognising when a number of them are present on the same company.
- No verifiable entry in the official business register, or details that don’t match what the company told you.
- A very new domain, or a brand-new registration, behind a company claiming a long history.
- No real physical address or phone number, only a contact form or a shared mailbox address.
- Payment demanded only by wire transfer, crypto, or gift cards, and strong pressure to pay quickly.
- Deals or returns that are too good to be true, and reluctance to put terms in writing.
- Reviews that are all extreme, all recent, or suspiciously uniform, or no online trace at all.
- Hidden or mismatched ownership, where you can’t tell who’s really in control.
- A name, logo, or website that closely imitates a well-known brand, which is a sign of impersonation.
How it plays out: three common patterns
These scams are easier to recognise in motion, so here are three patterns that recur constantly, and the single check that would have stopped each. They’re representative of how these frauds typically unfold rather than any one named case.
The ‘vanishing’ supplier. A business comes across a supplier who’s offering a very good price, pays a deposit on a large order and then the supplier just disappears. The clue was in the registration. The company either wasn’t in the register at all or had only been incorporated a matter of weeks prior despite the claim of years of trading. It would have been a two minute check of the register to have picked that up before a penny of the deposit had left.
The clean front with a hidden owner. A company passes every surface check, real registration, tidy website, no complaints, and only later turns out to have been controlled all along by someone with a string of fraud cases, or by a sanctioned individual, kept out of view behind a holding company. Nothing on the surface revealed it. Only a look at the real ownership and the people behind it would have.
The impersonator. Customers pay what they think is a familiar, trusted brand, through a site that copied its name, logo, and look on a lookalike domain. The real company never sees the money and takes the reputational hit anyway. A glance at the domain age and the exact web address, against the brand’s genuine one, would have shown the clone for what it was.
Manual vs automated verification
All the checks above can be done by hand, and for a one-off purchase or a single supplier, doing them yourself is perfectly sensible. Manual verification is free and, done carefully, effective against the obvious fakes. Its limits show up in two situations: when the fake is sophisticated, and when you’re checking not one company but many.
A very convincing fake, a very good shell with a legitimate owner buried two layers down, adverse media only in another language, can actually pass a manual check because the sheer volume of work involved in doing it manually across multiple databases and languages is so slow and so easy to get around. If you’re onboarding suppliers, customers or partners on a regular basis then manually checking each one simply won’t scale. That’s where automated verification comes in. Software that will check the entity, resolve the ownership, screen against sanctions and adverse media and then keep it under review over time. It does it in minutes rather than hours. The real truth isn’t manual versus automated as it’s often presented by the competition. It’s that automation does the volume and the depth of work so that people can actually focus their judgement on the things that matter.
When the easy checks aren’t enough
For a one off purchase from a shop you don’t know, the basic checks are usually more than sufficient; go through them and you’ll deal with the vast majority of scams. There is however a sensible threshold to be drawn and it’s precisely at that point that the expensive mistakes are made. The DIY checks will catch the obvious fakes and will simply not cope with the more sophisticated ones. At any significant scale the manual approach is going to be quietly missing things. That’s when checking that a company is legitimate ceases to be a 10 minute search and becomes a verification process. It becomes a process with a name and a well established methodology: Know Your Business. We go into that in our guide to KYB verification and we have a practical KYB checklist to help you assess a counterparty prior to you even sign.
Look past the front
The theme that runs through all of this is actually very simple. A registered company doesn’t automatically make it a legitimate company; it just means that someone’s completed a form. A slick website doesn’t make it a clean business; it’s just a few hundred quid and an afternoon’s work. The one thing that actually tells you whether a company is legitimate to do business with is what’s behind the front. It’s the ownership, the history and the people. That’s the bit that a scam is going to work hardest to hide and therefore it’s the bit you need to spend the most time looking at.
For businesses that want to do it properly and at scale Beady turns that manual exercise into a proper systematic process. It checks the company against over 200m legal entities and officers globally, identifies the real ownership and screens both the business and the people behind it against sanctions, adverse media and legal records with every finding traceable back to its source. You can therefore clear the people behind the company rather than just the website and do it in minutes rather than trawling through a dozen browser tabs.
If you’d like to see what a proper check surfaces on a company you’re weighing up, book a demo and we’ll run it with you.
