To find out if a company is legitimate, start with the state business registry where it claims to be incorporated, then work outward through complaint databases, licensing boards, its online footprint, and its physical address before you send any money. Each step catches a different kind of fraud, and none of them cost anything beyond a few minutes. The five checks below move from the most definitive proof of legal existence to the softer signals that round out the picture.
Step 1: Search the State Business Registry
Every state requires businesses to register with a government agency before they can legally operate, and those records are publicly searchable at no cost. The single most reliable way to confirm a company’s legal existence is to search the business entity database maintained by the Secretary of State (or equivalent agency) in the state where the company claims to be incorporated or organized. The search returns the company’s legal name, formation date, registered agent, and current status. It takes about two minutes.
Look for a status of “Active” or “In Good Standing.” That means the company has kept up with its required annual filings and fees. “Delinquent,” “Dissolved,” or “Administratively Revoked” means it has fallen behind. A dissolved company has lost its legal authority to do business and may no longer have limited liability protection for its owners. That isn’t always proof of fraud, but it’s a serious warning if the company is still soliciting customers or employees.
If a company claims to operate in multiple states, check both its home state (where it was formed) and any states where it has registered as a “foreign” entity. Most states also issue a Certificate of Good Standing as official proof the business is current on its obligations. Some companies will offer that certificate proactively when asked, which is itself a good sign.
What About the EIN?
Most businesses obtain a nine-digit Employer Identification Number from the IRS for tax filing, hiring, and opening bank accounts. You’ll see EINs on invoices, W-2s, and contracts. The IRS does not offer a public directory to look up a company by its EIN, and the IRS TIN Matching tool is designed for businesses to verify payees, not for consumers.
An EIN is still useful as a cross-reference. If a company provides one, check whether the name on those documents matches the name in the Secretary of State’s database. Inconsistencies between the legal name on government filings and the name attached to the EIN are worth investigating further.
Step 2: Check Complaints and Enforcement Records
Government agencies at both the federal and state level track complaints and enforcement actions against businesses. These records reveal patterns of deceptive practices, unresolved disputes, and active investigations that a clean registration record won’t show.
Federal Trade Commission
The FTC brings hundreds of enforcement cases each year against companies that violate consumer protection laws. Its Cases and Proceedings database lets you search by company name to find consent orders, injunctions, civil penalties, and other actions. If a company appears there, read the details. A consent order restricting a company’s future conduct means the FTC found enough evidence of wrongdoing to intervene. The FTC also publishes Consumer Alerts highlighting active scam patterns and specific companies to avoid.
State Attorney General
Your state attorney general’s consumer protection division is often the best resource for complaints from people in your area. Most states let you search complaints online or by phone. The National Association of Attorneys General maintains a directory at naag.org linking to every state’s consumer complaint resources. A company with dozens of unresolved state-level complaints is worth avoiding even if it hasn’t drawn federal attention.
Better Business Bureau
The BBB assigns letter grades from A+ to F based on complaint volume, response quality, transparency, and time in business. A high grade with an established complaint history is generally a good sign. Keep some perspective, though: BBB accreditation is voluntary, so the absence of a profile doesn’t mean a company is illegitimate. Some scam operations have also gamed the system by responding to complaints just enough to hold a decent grade. Treat the BBB as one data point, not a verdict.
Federal Court Records
For deeper digging, the Public Access to Court Electronic Records system (PACER) lets you search federal court cases nationwide. You can find out whether a company has been a defendant in lawsuits involving fraud, breach of contract, or employment violations. PACER charges $0.10 per page, but fees are waived if your account accrues $30 or less in a quarter, which is more than enough for a basic background check on a single company. Multiple judgments for non-payment or deceptive conduct point to a pattern.
Step 3: Verify Licenses and Industry Registration
Many industries require businesses and individuals to hold active licenses issued by state boards. Contractors, healthcare providers, real estate agents, insurance companies, and financial professionals all fall under some form of licensing. Every state licensing board maintains a searchable database that confirms current, unrestricted license status, shows required insurance or bonding, and lists any disciplinary actions.
This step catches a problem general business registration won’t. A company can be properly registered with the Secretary of State and still be operating without the industry-specific credentials it needs. If you’re hiring a contractor, confirming both state registration and an active contractor’s license gives you substantially more protection than checking only one.
Financial Firms and Advisors
If you’re evaluating an investment firm, financial advisor, or stockbroker, FINRA’s BrokerCheck is indispensable. It’s free, and it confirms whether a person or firm is registered to sell securities or offer investment advice, as required by law. BrokerCheck also shows employment history, regulatory actions, arbitration results, and customer complaints. Anyone selling investments who doesn’t appear in BrokerCheck is either unregistered (which is illegal) or misrepresenting their credentials.
Publicly Traded Companies
Public companies must file detailed financial disclosures with the Securities and Exchange Commission, and those filings are searchable through EDGAR. Annual reports (Form 10-K), quarterly reports (Form 10-Q), and current reports (Form 8-K) contain financial statements, risk disclosures, legal proceedings, and executive compensation. If a company claims to be publicly traded but has no EDGAR filings, the claim is false.
Step 4: Check the Company’s Online Footprint
A company’s digital history offers a timeline that’s hard to fake. These tools aren’t as authoritative as government databases, but they catch a different category of fraud: outfits that exist on paper but are misrepresenting their history, scale, or reputation.
Domain Age
ICANN’s registration data lookup at lookup.icann.org shows when a website’s domain was first registered. A company claiming ten years in business whose domain was registered three weeks ago is lying about something. Scam operations frequently spin up new domains because their old ones get flagged and blacklisted. The domain age should roughly match the company’s claimed history and its formation date in state records.
Cloned Websites
One of the more sophisticated scams involves cloning a legitimate company’s site under a slightly different URL. Watch for misspelled domain names (like “amaz0n.com” with a zero), unusual domain extensions (.net instead of .com for a well-known brand), and URLs that begin with “http” rather than “https.” Cloned sites often have blurry logos, inconsistent formatting, broken “Contact Us” pages, and payment portals that only accept wire transfers or cryptocurrency. When in doubt, type the company’s URL directly rather than clicking through an email or ad.
Social Accounts and Reviews
Verified accounts carry distinct markers: gold checkmarks for brands on X, blue badges on Meta platforms after identity verification. A brand-new account with almost no followers, no posting history, and only generic content is telling, especially when the company claims a long track record.
On independent review platforms, look for consistent patterns across multiple sites rather than fixating on any single review. A handful of negative reviews is normal for any business. A wall of nearly identical five-star reviews posted within the same week is a manipulation tactic. The most useful signal is consistency across sources: do the reviews, the government records, the domain age, and the company’s own claims all tell the same story?
Step 5: Verify the Address and Phone Number
A verifiable physical location adds accountability that purely digital businesses can’t easily fake. Take the street address from the company’s website or correspondence and check it in a mapping tool with street-level imagery. You want to see a real commercial space. Watch out for a residential home listed as headquarters for a supposedly large operation, or a commercial mailbox store (like a UPS Store) with a suite number designed to look like an office.
Virtual offices and shared addresses are common now and aren’t automatically suspicious, especially for small or remote-first companies. The concern is when a company presents itself as having major physical operations that don’t actually exist at the listed address. A startup using a virtual office is one thing. A “manufacturing company” running out of a mail-forwarding service is another.
Then call the number. A professional receptionist, automated phone tree, or voicemail that identifies the company by name all suggest a real operation. Disconnected numbers, personal cell voicemails, or numbers that ring endlessly are warning signs. If the company lists multiple contact methods, test more than one.
Pay With a Method You Can Reverse
Verification should happen before you pay, but the payment method itself is your last line of defense. Credit cards offer the strongest consumer protection because you can dispute fraudulent charges. Under the Fair Credit Billing Act, you have 60 days after a charge appears on your statement to file a written dispute for billing errors, and the card issuer must investigate.
Wire transfers through services like Western Union, MoneyGram, or Ria are essentially the same as sending cash. Once the money leaves, you almost certainly can’t get it back. The FTC warns explicitly against wiring money to anyone you haven’t met in person, regardless of the reason. Any company that insists on payment by wire transfer, cryptocurrency, or gift cards is waving a red flag. Legitimate businesses accept standard payment methods and don’t pressure you into irreversible ones.
For large transactions, a licensed escrow service can hold funds until both sides fulfill their obligations. Verify the escrow service itself before trusting it with your money. Fraudulent escrow sites are a known scam vector. A real escrow company will be licensed and bonded in its operating state, will hold funds in segregated trust accounts, and will never ask you to send money through person-to-person transfer services.
Job Offers and Recruiters
Fake job postings exploit people at a vulnerable moment, so the same verification logic applies with a few added patterns. The FTC identifies several specific signals of a fraudulent offer. Any “employer” that sends you a check and asks you to deposit it, keep a portion, and send the rest to someone else is running a fake check scam. The check will bounce days later, and you’ll owe the bank the full amount.
Other red flags: jobs that promise high pay for minimal work, positions that require you to pay upfront for certifications or training, and “reshipping” jobs that ask you to receive packages and forward them elsewhere (often purchased with stolen credit cards). Legitimate employers don’t charge you to get hired, and federal or postal jobs are always free to apply for regardless of what a third-party ad might claim.
When a recruiter contacts you by email, check whether the message actually comes from the company’s official domain. A note claiming to be from a major corporation but sent from a Gmail or Yahoo address is almost certainly fraudulent. Before responding, run the company through the same five checks above.