Picture a small online shop (an illustrative case) that orders 2,000 dollars of packaging from a supplier it found through an ad. The supplier's website shows a UK company number. On the Companies House register, that number belongs to a company with another name, dissolved in 2023. ICANN Lookup dates the website's domain to six weeks earlier, and the invoice asks for payment into a personal account in a third country. Three free lookups took ten minutes. The order stopped before any money left. A bank or payment firm runs the same lookups on every business customer it signs and keeps the evidence, because for a regulated firm they are the first steps of know your business (KYB) and UBO verification.
How do you verify a company's legitimacy online? 9 checks to see if it is legit
A company is legit when its public records agree with each other and with what it tells you. Check a company's legitimacy online in this order. The first ones need only a name and a number.
1. Is the company registered, and is its record current?
To check business registration, search the official register by name and by number, then compare both results with the invoice. In the UK that is Companies House; in the US a company registers with a state, not with the SEC. Read the status, the incorporation date and the filing history.
Companies House does not check the accuracy of what is filed. Since 18 November 2025, though, a company cannot file its confirmation statement unless every director has verified their identity (Companies House guidance), so an overdue statement deserves a question. A firm active in financial markets may also carry a legal entity identifier.
Fail line: no record, a dissolved record, or a number registered to another name.
2. Does it hold the license its trade needs?
Almost all financial services firms in the UK must be authorized or registered by the FCA. Its guidance on avoiding scams tells consumers to match the firm reference number (FRN) and the contact details they were given with the Firm Checker, because some firms pretend to be authorized ones. Licensing for other trades sits with local or sector bodies.
Fail line: no entry, or an entry whose phone, email or website differs from the ones you were given.
3. Is the address real, and does the contact information match?
Look the registered address up on a map. A house, a virtual office or a building that hosts hundreds of unrelated companies can be lawful, yet it tells you no trading premises stand behind the name. Confirm contact information by calling the number on the register or the regulator's list. The number on the invoice proves nothing.
Fail line: no address, or a phone line and email that nobody answers.
4. Who are the directors, and is your contact one of them?
The register names the officers, and Companies House lets anyone search by officer name and look up disqualified directors. Compare those names with the person who sent the quote. Then look at that person's digital footprint: a LinkedIn or Facebook profile, past roles, an email on the company's own domain. A social media page can be set up in a day, so look for a history that predates your deal.
Fail line: your contact has no visible link to the company, or a director sits on many dissolved companies.
5. Can you see who owns the company?
Sometimes. In the UK, people with significant control (usually anyone holding more than 25 percent of the shares or votes) are published on the register unless protected. In the US, a FinCEN rule of 14 August 2026 continues to exempt companies from reporting their US owners.
Canada has required federal corporations to file their individuals with significant control since 22 January 2024, and says only some of it will be made public.
A regulated firm follows the chain to its end: KYB and UBO verification traces each parent and controlling entity until it reaches natural persons.
Fail line: the owner is unnamed, or the chain ends in a company you cannot look up.
6. How old is the website, and who registered the domain?
Since 28 January 2025, RDAP has been the source of registration data for generic domains, in place of the old WHOIS services (ICANN). What people still call a WHOIS lookup now runs through ICANN Lookup. Owner fields are often nonpublic. Read the creation date.
An SSL padlock proves only that the connection is encrypted. ScamAdviser's free website checker gives a second opinion on a URL, and a name one letter away from a real firm's points to phishing.
Fail line: a domain weeks old on a company that claims years of trading.
7. What do online reviews and complaints say, including the BBB?
Read Trustpilot, Google Business Profile, Sitejabber and, for US and Canadian firms, the Better Business Bureau (BBB). Analyze the complaints before the star ratings. The FTC's rule against fake reviews, in force since 21 October 2024 (16 CFR 465.2), bars a business from writing reviews by people who do not exist, and from buying them if it knew or should have known.
On 22 December 2025 the FTC warned 10 companies about the rule, citing civil penalties of up to $53,088 per violation.
Fail line: a burst of five star reviews in one week, or repeated complaints of goods never delivered.
8. Is the company or its owner on a sanctions list or in the news?
Search the company and each named owner against OFAC's free Sanctions List Search, the UN and EU lists and the UK Sanctions List. The free sanctions check runs several of these lists in one search.
Then search the news for fraud, legal disputes, court records and fraud blacklists, the adverse media screening step a bank runs on business customers.
Fail line: a list match confirmed by a second identifier, such as an address or a registration number.
9. Does the payment request match the company?
The account name should match the company's legal name, in the country where it trades. Treat a request for gift cards, crypto or a personal account as a stop, and confirm any change of bank details by phone on a number you already hold. This is the step where fraudsters impersonate real businesses.
Fail line: the account holder is not the company, or the request comes with a deadline.
| Check | Where to look for free | Fails when | What a regulated firm adds |
|---|---|---|---|
| 1. Registration and status | National or state register | No record, dissolved, number belongs to another name | Dated register extract kept on file |
| 2. License | Regulator's public register | Not listed, or contact details differ | License evidence and scope checked |
| 3. Address and contact | Map, register, regulator | No premises, nobody answers | Proof of address from an independent source |
| 4. Directors and contact person | Officer search on the register | Contact not linked to the company | Identity verification of directors and signatories |
| 5. Owners | PSC, ISC or national owner register | Owner unnamed, chain ends abroad | Owners traced to natural persons and verified |
| 6. Website and domain | ICANN Lookup (RDAP) | Domain weeks old, lookalike name | Domain matched to the registered name |
| 7. Reviews and complaints | Review sites, BBB | Review bursts, delivery complaints | Complaint history weighed in the risk rating |
| 8. Sanctions and news | OFAC, UN, EU and UK lists, news | Confirmed list match | Every party screened, then monitored |
| 9. Payment request | Your own records, a known phone number | Account holder is not the company | Account name matched before the first payment |
Table 1. The nine checks, the free source for each, the fail line and what a bank or payment firm adds (as of November 2026).
Which free registers and tools verify a business, country by country?
| Country | Free register | What it shows | Watch for |
|---|---|---|---|
| US | The register of the state of formation | The formation record; SBA says a business registers "with the state" | EDGAR holds only documents filed with the SEC under the securities laws |
| UK | Companies House | Status, officers, PSCs, filings, dissolved companies | It does not check the accuracy of what is filed |
| EU | The national register of the member state | Company records; all EU business registers interconnected and searchable since June 2017 | Owner registers open to a legitimate interest |
| Canada | Corporations Canada | Corporations formed under federal law | Provincial companies sit in provincial registries |
| Australia | ABN Lookup | Whether an ABN is active or canceled, business type, GST status | An ABN may be canceled if records show no business is carried on |
| India | Ministry of Corporate Affairs | Company and LLP records | Match the company name and number on the invoice |
| Philippines | Securities and Exchange Commission | Corporations registered with the SEC | Match the SEC registration number on the documents |
| Nigeria | Corporate Affairs Commission | Search or verify a business | Match the RC number on the invoice |
| South Africa | CIPC | Company and close corporation search | Match the registration number |
| Türkiye | Trade Registry Gazette and MERSIS | Trade name search and published registry notices; MERSIS gives each legal entity a single number | Free gazette search needs a member login |
Table 2. Where to look a company up for free, by country (opened 9 November 2026).
Start with the register of the country where the company says it is incorporated, which may differ from where it sells. A register confirms the name, number and status and says nothing about the people you deal with. Firms that look up hundreds of business customers a month buy the extract from business verification services instead of searching by hand.
When the country is unclear, use verification tools and databases that span many registers: OpenCorporates gathers records from 140+ jurisdictions (as of November 2026), and the GLEIF search covers every entity with a legal entity identifier.
Which common signs and red flags show a company is a scam, fraudulent or high risk?
The packaging supplier gave itself away three times: a company number that belonged to someone else, a domain six weeks old and a personal account abroad. None of the three needed a paid tool, and the red flags below that may signal a fraudulent or high risk company can all be read from the same free checks. One sign alone is a reason to ask. Several together are a reason to stop.
- Claimed history against the record. "Trading since 2005" on a company incorporated last year.
- No owners, or an offshore chain. A parent in a jurisdiction that publishes nothing about owners, or in a country on the FATF's lists.
- Shared or empty address. Hundreds of unrelated companies registered at one office.
- Pressure. A discount that ends today, or a price far under the market.
- Refused documents. No certificate of incorporation, license, tax number or list of owners when asked.
- Free email only. A webmail address for a company that claims a large team.
- Payment details that change. A new account sent by email after the deal is agreed.
For a bank, the same signs move a business customer into the high risk customers group, where enhanced due diligence applies.
Can you check a company for free, and what does a free check miss?
Yes. Every check in Table 1 can be run free. A free check still misses the part a regulated firm pays to close:
- Owners the register does not show. Where no owner register is open to you, the owner you see is the one the company declares, and US companies no longer report their US owners to FinCEN at all.
- Edited documents. A PDF certificate can be altered, so compare it with the register, never the other way round.
- Change after the lookup. A register extract is true on its date. A director can resign or a new owner arrive the week after.
- News in other languages. A court case reported abroad will not show in an English search.
- Links between parties. Two suppliers that share a director look independent until someone compares them.
Picture a distributor (illustrative) checked in March: register clean, owners named, no news. In May a new shareholder appears on the register, and by July that shareholder is under investigation abroad.
How do you report a scam business online?
Report a scammer business online where the people who can act will see it:
- US: the FTC at ReportFraud.ftc.gov.
- UK: Report Fraud takes cases from England, Wales and Northern Ireland online or on 0300 123 2040; Police Scotland takes them on 101 (NCSC).
- EU: the European Consumer Centre in your own country helps a consumer settle a dispute with a seller based in another EU country, Iceland or Norway (European Commission).
- The domain: ICANN Lookup names the registrar of a fake website; send the abuse report to that registrar.
- The platform: marketplaces, social networks and review sites carry a report button on the listing itself.
Keep the invoice, the emails and the payment record before you report, and if you paid, call your bank at once. A match on a sanctions list is a different matter. A regulated firm owes a report to the authority for it.
When does checking a company become KYB under AML rules, and how does automation help?
When the checker is a bank, a payment firm, a marketplace or another firm under anti money laundering (AML) rules, the nine checks feed its know your business duties. The firm keeps evidence of each check. It traces owners to the natural persons at the end of the chain, past the first company, and it keeps checking after onboarding.
Software does the lookups at that scale. On complead, formerly Sanction Scanner, "The entity is confirmed against official registers and vetted sources." Next, the chain of owners is followed with no fixed depth cap, and "Every party is screened against sanctions, PEP, watchlists, and adverse media". Shareholding, directors, status and filings stay monitored continuously, so a new shareholder like the distributor's is screened when it appears. Whether a specific structure is blocked in a given jurisdiction remains, in the product page's words, "a determination for your compliance function and counsel".
Procurement teams carry the same problem with suppliers: US persons are generally prohibited from dealing with a seller on OFAC's SDN List, even for a one off invoice of 500 dollars. Candex, a US based master vendor, takes that check off its enterprise buyers and screens and monitors every long tail supplier on complead.
Which 2026 changes matter when you check a company?
- 28 January: the OFSI consolidated list closed, and UK designations now sit on the UK Sanctions List alone (gov.uk).
- 25 March: the FTC told Congress that consumers filed 3 million fraud reports in 2025, with $15.9 billion lost (FTC testimony, p. 2).
- 10 July: EU states were due to open owner registers to a legitimate interest, which covers anyone "likely to enter into a transaction" with the company who wants to keep that deal clear of money laundering (Directive (EU) 2024/1640, Art 12(2)(c) and Art 78(1)).
- 14 August: FinCEN's final rule kept US owners out of beneficial owner reports (Corporate Transparency Act).
- Mid November: the 12 month transition in which existing UK directors verify with their next confirmation statement ends (Companies House); the transition plan, updated 23 October 2026, puts the end of the transition for everyone on the register at the end of 2026 at the earliest and presenter verification no earlier than November 2027.
Count the failed checks before any money moves. With none, pay. With one, ask for the document that would settle it and give the company a day to send it. With two, or with a failed payment check, walk away. A firm that signs business customers has a further question to settle in its own rules: whether this check is KYB, with an owner trace, a dated record and monitoring after the first payment.
