How to Verify a Company Is Legitimate: A Field Checklist

The company looks real. The website has a team page, a street address, a support line, and case studies with stock-photo smiles. You're about to wire them money, ship them freight, or onboard them as a vendor. The question isn't whether the company looks legitimate — looking legitimate is cheap. The question is whether independent sources agree it exists, operates, and is who it says it is.

Here's the sequence that answers that, in the order that catches the most problems soonest.

Start with the registry, not the website

Every claim on a company's website is self-reported. Start where claims are filed under penalty instead: the government registry — the Secretary of State in the US, Companies House in the UK, and their equivalents elsewhere. You're checking four things: the exact legal name (not "close enough" — lookalike names are a technique, not a coincidence), the status (active and in good standing, not dissolved or suspended), the formation date, and the registered address and officers.

The formation date does quiet, useful work. A company "serving customers for two decades" that was registered eleven months ago hasn't necessarily lied to you yet — but something needs explaining, and you now know to ask.

Read the digital footprint like a timeline

A legitimate operating history leaves sediment. Check when the domain was registered — a WHOIS lookup takes seconds — and compare it against the company's claimed age. Look at archived versions of the site: did it exist two years ago, and did it say the same things? Is there a hiring trail, business listings, an actual footprint of operating?

None of these alone is a verdict. Fresh domains happen for honest reasons (rebrands, acquisitions). But a three-month-old domain, no archive history, and a claimed twenty-year track record — that combination is a pattern.

Verify the phone and the address separately

A phone number that only exists on the company's own website proves nothing; anyone can print a number. What's checkable: whether the line is a real fixed or mobile line versus a freshly provisioned VoIP number, and whether the number appears in independent listings tied to that business name.

Addresses are the same game. Does the street address resolve to actual commercial premises, a virtual-office suite, or someone's apartment? Virtual offices are legitimate for plenty of small companies — but a "national logistics firm" whose headquarters is a mailbox deserves a longer look.

Corroborate — don't collect

Here's the habit that separates verification from research theater: every fact needs a second, independent source. The registry confirms the entity; an independent directory confirms the phone; the map data confirms the premises; the archive confirms the history. Five facts that all trace back to the company's own website are one fact wearing five hats.

Build the little matrix in your head (or on paper): identity, address, phone, web presence, safety signals — each row checked against a source the company doesn't control. Rows that come back contradicted matter more than rows that come back empty. Automated tools — company verification runs this whole sequence in one pass — are mostly valuable because they never skip the boring rows.

Watch for the lookalike play

The nastiest version of company fraud doesn't invent a company at all. It impersonates a real one: right name, right registration number, real reputation — wrong phone number and wrong bank account. The registry checks out because the company is genuine; it's the contact channel that's fake.

So verify the channel, not just the entity. Did this deal arrive through contact details the real company publishes, or through a domain one letter off and a mobile number nobody's heard of? In freight, this exact move powers double brokering; in AP, it powers vendor impersonation. The company is real. Your counterparty isn't the company.

Know when to walk away

Three findings justify ending the conversation regardless of everything else: contradiction between independent sources (the registry says dissolved, they say thriving), pressure to skip verification ("we need this signed today, our references are on vacation"), and unreachability through published channels (the only number that answers is the one they gave you).

Legitimate companies survive verification constantly. It's the illegitimate ones that need you to hurry.

Frequently asked questions

What's the fastest way to verify a company is legitimate?

Registry lookup plus domain age, in that order — about five minutes combined. Those two catch the largest share of outright fakes: entities that don't exist, aren't in good standing, or whose online history contradicts their story. Everything after that is corroboration and channel verification.

Are registry records enough on their own?

No. Registration proves an entity was filed, not that it operates honestly — shell companies are registered too, and lookalike fraud impersonates genuinely registered companies. The registry is the anchor for the entity; you still verify the channel you're dealing with.

What does a recently registered domain actually mean?

By itself, not much — rebrands and new ventures are real. It matters in combination: a fresh domain plus an old-company story, or a fresh domain plus a name one letter off an established brand, is when it graduates from data point to red flag.