A new supplier, client or partner wants your money, your signature or your documents. Before you agree, you can find out a great deal about them from free public records in under half an hour. This is the workflow we use ourselves, with the limits of each check stated plainly.
Knowing how to check if a company is legit is mostly a matter of order. Start with the things a real business cannot avoid having: a legal name, a registration, an address and a bank account in its own name. Leave reviews and impressions until last, because they are the easiest things to fake.
One caution before the steps. These checks tell you whether a business exists and whether its story is consistent. They do not tell you whether it is honest or good at its work. A registered company can still let you down, and an unregistered sole trader can be perfectly genuine.
Step 1: Ask for the exact legal name
A brand name is not a legal identity. Ask for:
- the full registered name of the business;
- the country, and where relevant the state or province, it is registered in;
- its registration or company number;
- its registered address.
A genuine business answers this in one line, because the same details go on its invoices. If the answer is slow, vague or changes, note that. In a case we published today, we could not find a legal entity name on either of two websites that approached us, and that was the main reason we did not proceed.
Step 2: Look it up in the official register
Search the government register for the country they named. Use the register’s own website, reached by typing its address yourself.
| Country | Where to look | Worth knowing |
|---|---|---|
| United Kingdom | Companies House | Free. GOV.UK lists what you can see: registered address, date of incorporation, current and former officers, filed documents and insolvency information |
| United States | The Secretary of State business search for the state they name | Companies register with a state, not with a single national register. Search the state named on their paperwork |
| Australia | ABN Lookup and the ASIC registers | ABN Lookup shows whether a business number is active and who it belongs to |
| Canada | Corporations Canada for federal companies, or the provincial registry | A company may be registered federally or in one province |
| India | The Ministry of Corporate Affairs company master data search | Covers companies and LLPs. Sole proprietorships are not listed there |
| Ireland and the EU | The Companies Registration Office in Ireland; the EU e-Justice portal links national registers | Each member state keeps its own register |
If you do not know the country, that is itself a finding. A business that will not say where it is registered has not given you anything to check.
Step 3: Compare the record with what you were told
Finding a matching name is not the end of the check. Read the record.
- Status. Is the company active, or dissolved, struck off or in liquidation?
- Age. Does the incorporation date fit the history they describe? A company formed last month that claims ten years of trading needs an explanation.
- Address. Does the registered address match the one on their website and invoice?
- People. Are the directors or officers the people you are dealing with, or people they can connect you to?
- Exact name. Fraudsters often use a name one word away from a real company. Match the number, not just the name.
Be fair about what a blank result means. It shows that name was not in that register on that day. The business may trade under a different legal name, be registered in another country, or be a sole trader. Ask them which. A genuine business can tell you.
Step 4: Check the domain and the email address
Public domain records add useful context. The ICANN registration data lookup shows when a domain was registered and through which registrar.
- Domain age. A very new domain is not proof of anything, but it should fit the story. In our vendor-registration case study, the sender’s domain was about two months old, while the company it claimed to represent had held its own domain since 1998.
- The address after the @. It should be the company’s own domain, the same one as its website. A lookalike domain or a free mailbox for a large organisation deserves a question.
- Authentication is not identity. An email can pass every technical check and still come from someone who is not who they claim to be. Those checks confirm a domain, not a person.
Before you open any link they send, run it through a checker or read our guide on how to check a link before you click.
Step 5: Read the website like a contract
Skip the home page and go to the footer.
- Terms and conditions. Which legal entity do they name? Is there a governing law?
- Privacy policy. Does it exist, and does it name the organisation responsible for your data?
- Contact page. Is there a postal address and a phone number, or only a form?
- Consistency. Do the name, address and number match the register and the invoice?
A site can look polished and still name nobody. That gap matters more than the design.
Step 6: Make contact through a route you found yourself
Do not verify a message using the contact details inside the message. Find the company’s phone number from the register, its official website or a past invoice, and call it. Ask whether the person who contacted you works there and whether the offer is real.
This single step is what exposes impersonation, where the company is genuine but the person writing to you is not part of it.
Step 7: Check where the money is going
- Account name. The bank account should be in the name of the business you verified. A personal account or a different company name needs a clear reason.
- Country. The account should normally be in the country where the business is registered.
- Method. Bank transfer and card payments leave a trail. Requests for cryptocurrency, gift cards or money-transfer services for a business purchase are a strong warning sign.
- Timing. Pressure to pay in full, today, before any paperwork exists, is a reason to slow down.
If an existing supplier tells you their bank details have changed, treat that as its own check. Our guide to fake invoices and changed bank details covers the procedure.
Step 8: Use reviews and references last
Reviews are worth reading, with care. Look for detail, dates spread over time and responses from the business. Be wary of a burst of short five-star reviews, or of testimonials that appear only on the company’s own site.
A reference you can telephone, at a company you can verify in the same way, is worth more than any number of stars.
Step 9: Keep a record
Save what you found: the register page, the domain record, the terms and the emails, each with the date. Websites change. If something goes wrong later, a dated record is what your bank, your insurer or the police will ask for.
Checking a message or a link from a company you do not know?
Paste the email into ScamCheck’s email checker or the address into the link checker. Both are free and need no sign-up. They assess wording and link risk. They do not replace the register search.
The ten-minute version
If you only have ten minutes, do these four things, in this order:
- Get the legal name, country and registration number in writing.
- Find that number in the official register and read the status, age and address.
- Call the company on a number you found yourself.
- Confirm the bank account is in that company’s name.
If any one of these cannot be completed, you have your answer for now: not yet.
What these checks cannot tell you
- Registration is not a quality mark. A register records that a company exists. It does not vouch for it.
- Sole traders are often invisible. In many countries an unincorporated business appears on no public company register.
- Real companies can be impersonated. Everything on the register can be true while the person emailing you has nothing to do with it. Step 6 is the defence.
- Records can be out of date. Check the last filing date as well as the details.
The bottom line
A legitimate business leaves a trail it did not write itself: a register entry, a domain record, a bank account in its own name and a phone line that answers. Check the trail, in that order, before money or documents leave your hands.
Most of the time the checks confirm what you hoped. The few times they do not are the ones that pay for the habit.
Frequently asked questions
How can I check if a company is legit for free?
Ask for its legal name and registration number, then search the official company register for the country it names. In the UK that is Companies House, which is free. Compare the status, incorporation date and address with what you were told.
What if I cannot find the company in any register?
It may trade under a different legal name, be registered in another country, or be a sole trader that the register does not list. Ask which applies. If the business will not tell you its legal name or where it is registered, do not pay until it does.
Is a professional website proof that a business is real?
No. A website is easy to build and easy to copy. Look at whether its terms name a legal entity, whether it gives a postal address and phone number, and whether those match the official register.
Does a new domain mean the company is fake?
Not on its own. New businesses have new domains. It becomes a concern when the domain age does not fit the history the company describes, or when the domain only resembles that of a well-known organisation.
How do I check a company in the United States?
Companies in the United States register with an individual state. Search the Secretary of State business database for the state named on the company’s paperwork, using the exact legal name or entity number.
This guide describes public checks that anyone can run. It is general information, not legal, financial or credit advice, and passing these checks does not guarantee that a business is trustworthy. See our disclaimer.
Related reading: What we could verify about a sponsored-content offer · Fake invoices and changed bank details · Google Business Profile scam calls · The web design lead that didn’t survive a background check · How we spotted three fake hosting billing emails
Need these checks to run automatically when a new supplier or client signs up? We build fraud-prevention and verification automation for small businesses.