How to Verify If a Company Is Legitimate: 7 Checks Before You Trust a Business

How to verify if a company is legitimate

Is this company legit? To verify that a company is legitimate, confirm it appears in an official business registry, match its address and contact details, check the age and security of its website, look up its tax or company number, read independent reviews and regulator warnings, and identify who owns it.

If you are trying to work out how to find out if a company is legit before you send money, sign a contract, take a job offer, or onboard a supplier, the good news is that most of the answer is public. A real business leaves a paper trail across government registers, tax records, and the open web. A fake one usually cannot fake all of it at once. The seven checks below move from the easiest and most decisive to the more subtle signals, so you can stop as soon as something clearly does not add up.

1. Confirm the company is registered in an official business registry

The single most important check is whether the business exists as a legal entity. Every legitimate company is recorded in a government register in the country where it was formed, and almost all of those registers are searchable for free. Search the exact legal name (not just the brand or website name) and confirm the status reads active or in good standing, not dissolved, struck off, or in liquidation.

Start with the primary government source: Companies House in the UK, a Secretary of State search or SEC EDGAR in the US, or the national register linked from the EU e-Justice portal. OpenCorporates is a fast way to search across jurisdictions, and in Italy the official record sits in the Registro Imprese.

If the company handles money, payments, or crypto, the registry check goes one step further. In the United States, a firm that transmits money or exchanges currency has to be registered as a money services business with FinCEN and licensed in the states where it operates. A payments company that is not on the FinCEN registrant list is a serious warning sign, whatever its website claims.

2. Match the registered address, phone, and email domain

A legitimate company's contact details agree with each other and with the public record. Take the address, phone number, and email domain shown on the website and cross-check them.

• Search the address in a maps tool. A real head office looks like an office or a known building, not an empty lot, a residential flat, or a virtual mailbox provider.
• Call the phone number. A working, answered line that matches the business name is a strong positive signal.
• Check the email domain. Correspondence from a company domain (name@company.com) is far more credible than free webmail such as Gmail or Outlook.com for anything above a small sole trader.

None of these on its own proves fraud, but when the address is a mail drop, the phone goes nowhere, and the only contact is a free webmail account, you are almost certainly not dealing with an established business.

3. Inspect the website: domain age, HTTPS, and a real contact trail

Fake companies are cheap to spin up, so their websites tend to be new and thin. Three quick web checks catch most of them.

1. Domain age. Run the domain through a WHOIS lookup. A site registered a few days or weeks ago that claims a long trading history is a contradiction worth pausing on.
2. Security. The site should load over HTTPS with a valid certificate. Missing HTTPS on a page that asks for payment or personal data is a hard stop.
3. Substance. Look for a real About page, named people, a physical address, terms and a privacy policy, and consistent branding. Legitimate sites rarely rely on stock everything with no named humans behind it.

4. Find and verify the tax or company number

Beyond the entity name, most jurisdictions issue a number you can verify independently. In the United States that is the Employer Identification Number (EIN); in the United Kingdom, the company number from Companies House; across the European Union, the VAT number, which you can validate in seconds through the European Commission's VIES VAT checker. A company that will not share a verifiable number, or gives one that fails validation, has failed a check that a real business passes without thinking.

5. Search for reviews, complaints, and regulator warning lists

Now bring in what other people and the authorities have already found. Search the company name alongside words like "scam," "complaint," "review," and "fraud," and check the sources that specialise in this.

• Independent review platforms and the Better Business Bureau for a pattern of complaints and how the company responds.
• Regulator warning and alert lists. Financial regulators publish names of firms they have flagged, for example the UK Financial Conduct Authority Warning List and the US Securities and Exchange Commission investor alerts.
• Sanctions and enforcement records if you are dealing across borders or at any size.

One angry review is noise. A consistent pattern of the same complaint, or a named entry on a regulator's warning list, is decisive.

6. Identify who really owns and controls the company

A legitimate business is willing to be transparent about the people behind it. The individuals who ultimately own or control a company are its ultimate beneficial owners, and in many countries that information now sits in a public or semi-public register. Directors and officers usually appear in the same registry filing you already pulled in check 1.

Watch for ownership that is deliberately hard to trace: layers of holding companies in secrecy jurisdictions, nominee directors, or a refusal to name a single real person. Structure alone is not proof of wrongdoing, but opacity where transparency is normal is a reason to slow down and ask more questions.

7. Know the red flags of a fake company

Once you have run the checks above, the pattern is usually clear. This is what a legitimate company looks like next to a likely fake one.

The most reliable single tell is pressure. A real company is comfortable with you taking a day to check the register and read reviews. A scammer needs you to act before you can.

A checklist you can run in about ten minutes

For a quick pass, work down this list. If the first three fail, you already have your answer.

1. Legal name found in the official business register, status active.
2. Address, phone, and email domain all match and check out.
3. Website uses HTTPS, the domain is not brand new, and real people are named.
4. Tax or company number verifies independently (EIN, company number, or VAT).
5. No pattern of scam complaints and no regulator warning-list entry.
6. Beneficial owners and directors are identifiable.
7. No high-pressure tactics or payment-only-by-untraceable-method demands.

How businesses verify other businesses at scale

Running these seven checks by hand is fine when you are vetting one company. Banks, fintechs, marketplaces, and payment firms have to verify every business customer they onboard, sometimes thousands a month, and re-check them over time as ownership and risk change. That process is called KYB, or Know Your Business: the business equivalent of the identity checks a bank runs on individuals.

Done properly, KYB verification automates exactly the checks above. It pulls the company record straight from official registries, resolves the ultimate beneficial owners, screens the business and its owners against sanctions and watchlists, and keeps the result current. Zyphe's KYB verification does this without hoarding the underlying documents: the company is verified, the sensitive records are not left sitting in another database waiting to be breached. For a compliance team, that is the difference between a manual check that does not scale and a control that runs on every customer, every time.