How to Check if a Company Is Legit Before You Start Work
A new client email lands in your inbox with a real budget and a tight deadline, and the only thing standing between you and a signed proposal is a nagging question about whether the company behind it actually exists. This guide shows how to check if a company is legit using public records anyone can read, in roughly the order a careful freelancer or agency owner would work through them, and how to decide what the results mean for your payment terms.
Published October 20, 2026
Why a quick legitimacy check pays for itself
Service work is almost always paid after it starts. You block out time, turn down other projects and deliver drafts before the first invoice clears. That arrangement depends on trust, and trust is easy to fake with a polished website and a confident first call. A shell company, a business that was dissolved last year, or a team with a history of leaving vendors unpaid can all look exactly like a good client in the first email.
A legitimacy check does not have to be a research project. Most of the useful evidence sits in a handful of free public sources: the state business registry, domain registration records, the website itself, the company's mail setup, public reviews, public court indexes and government sanctions lists. Twenty minutes of looking tells you far more than any amount of reading between the lines of a friendly message. If you want a broader framework for the whole intake process, our page on client due diligence walks through it end to end.
Confirm the legal entity in the state registry
Every corporation and LLC in the United States is formed by filing with a state office, usually the Secretary of State. That record is public and searchable online. Ask the client for its exact legal name and state of formation, then look it up. You want to see three things: a name that matches what the client gave you, a status of active or in good standing, and a formation date that makes sense for the story you were told.
A company that says it has served customers for ten years but was formed four months ago deserves a follow-up question. A status of dissolved, revoked, forfeited or delinquent means the entity may not legally be able to sign your contract, and it often means unpaid state fees or missed annual reports. Our business entity search guide covers how to read each registry, and the secretary of state business search article lists the filing office for every state.
Check how old the domain is
Domain registration records are public through RDAP, the modern replacement for WHOIS lookups. The registration date tells you how long the client's web address has existed. An established business with a domain registered three weeks ago is unusual. A brand new startup with a new domain is normal, but it changes how much risk you are taking.
Compare the domain age with the registry formation date and with what the client says about its history. When all three line up, that is a good sign. When the company claims a long track record but both the entity and the domain are weeks old, slow down and ask for more.
Review the website and its mail setup
Open the client's website and read it the way a skeptic would. Does it load over HTTPS without warnings? Does it describe real services, real people and a real way to reach the business? Templates with stock photos and no specific details are not proof of fraud, but they are not proof of anything else either.
- Check that the site answers at the domain the client used in email.
- Look for a business name that matches the registry record.
- Notice whether pages are thin, copied or full of broken links.
- Check whether the contact page offers anything beyond a web form.
A working business usually has a working mail setup. You can see the public DNS records for any domain: MX records show where mail is delivered, SPF lists which servers may send mail for the domain, and DMARC tells receiving servers what to do with mail that fails those checks. A company sending you a five-figure proposal request from a domain with no MX records, or from a free consumer mailbox while claiming to be an established firm, is giving you a signal worth noting.
These records are not a verdict on their own. Plenty of small, honest businesses have incomplete mail settings. They matter most in combination with the other steps.
Read reviews and listings for patterns
Public reviews on business listing sites, review platforms and professional directories help in a different way. You are not looking for perfection. You are looking for patterns, especially from other vendors and contractors rather than retail customers. Repeated mentions of late payment, disputed invoices or projects abandoned halfway are the ones that matter for you.
Read the company's replies as well. A business that answers complaints calmly and with specifics is behaving very differently from one that ignores them or attacks the reviewer.
Search public court and news records
Lawsuits by former vendors, mechanics liens on construction projects and news stories about unpaid contractors are all public. Search the company name in local news and in public court indexes such as PACER for federal cases or your state court portal. Keep the search to the business itself and its business conduct. Lawsuits are common and one case says little, but several collection actions by different vendors in a short period tell a clear story.
Screen against sanctions lists
Every US person and business is prohibited from doing business with parties on the OFAC Specially Designated Nationals list and other government sanctions lists. It is rare for an ordinary client to appear there, but the check is simple and the consequences of missing a match are serious, especially for international clients or clients paying from overseas accounts. Search the company name and the names of the principals you deal with in their business role.
Turn findings into payment terms
The point of all this is not to accuse anyone. It is to set terms that match the risk. A client with an active entity, a domain that has existed for years, a working website and mail setup, and no pattern of complaints can reasonably get standard terms. A client with thin or conflicting signals can still become a great client, but it makes sense to ask for more protection.
- Low risk: your usual deposit and net terms.
- Some open questions: a larger deposit and milestone billing.
- Serious red flags: payment in advance for each phase, or a polite no.
These are general suggestions for business terms, not legal advice. If a contract is large, a lawyer in your state can tell you what protections apply.
Doing it in one minute instead of twenty
The steps above work, but repeating them for every inbound lead takes time most freelancers and small agencies do not have. ClientVetter runs the same checks from one domain: registry match and status, domain age, website and HTTPS, mail records, a reviews summary, dispute and non-payment mentions, and sanctions screening. It scores the result from 0 to 100 with a Low, Watch or High band and a written reason behind every flag. Paying members can also see evidence-backed non paying clients reports from other members, with the reported company's reply shown alongside.
ClientVetter only covers businesses and people in their role at a business. It is not a consumer reporting agency, and its reports are not for credit, insurance, employment or housing decisions about individuals. The fcra compliant background check page explains the limits in plain words.
Check your next client before the first invoice
Type the client's domain and see the public signals in about a minute. The partial preview needs no card, and plans start at $49 a month or $24 a month billed yearly.