How to Know if a Business Is Legitimate With 12 Public Signals

Why signals beat gut feeling

Most people judge a new client on the quality of the first conversation. That is a reasonable start, and also exactly what a bad actor optimizes for. A signal is different from an impression because it comes from a record the client did not write: a filing with the state, a registration date kept by a domain registry, a DNS entry, a court docket. Records are harder to fake than a friendly tone, and they do not change depending on who is asking.

The twelve signals below fall into four groups: identity, online footprint, reputation and compliance. Strength in one group does not cancel weakness in another. A business with a perfect registry record but a trail of unpaid vendor lawsuits is real and still risky. If you prefer a step by step process instead of a checklist, the companion guide on how to check if a company is legit walks through the same ground in order.

Identity signals one to three

Signal 1, a registered legal entity. Corporations, LLCs and limited partnerships exist because someone filed formation documents with a state office. Search the exact legal name in the state registry. If you cannot find an entity anywhere, ask which state it was formed in. Sole proprietors may only have a local business license or a fictitious name filing, which is legitimate but gives you less to verify.

Signal 2, an active status. Registries show whether an entity is active, in good standing, delinquent, suspended, forfeited, revoked or dissolved. The labels vary by state, and our llc lookup page explains what each one usually means. Anything other than active deserves a question before you sign.

Signal 3, a consistent story. Compare the formation date, the registered agent and the state of formation with what the client told you. A company that describes itself as a long established firm but was formed a few weeks ago, or a business that says it is local but was formed in a state it has no other connection to, is not automatically suspicious, but the mismatch needs an explanation.

Online footprint signals four to six

Signal 4, domain age. Public RDAP records show when a domain was registered. Long registration history suggests continuity. A domain created days before the first email, used by a company claiming years of history, is one of the most common patterns in invoice fraud and impersonation.

Signal 5, a working website over HTTPS. The site should load at the domain used in email, show no certificate warnings, and describe specific services, specific people and a specific way to reach the business. A page that is nothing but a template with stock images and lorem style text tells you little.

Signal 6, a working mail setup. Look up the domain's MX, SPF and DMARC records. A business that sends from its own domain usually has MX records so it can receive replies and an SPF record so its mail is delivered. DMARC is a further sign that someone takes the domain seriously. Missing records are common in very small businesses, so treat this signal as supporting evidence rather than a verdict.

Reputation signals seven to nine

Signal 7, public reviews with a real history. Ratings on listing sites and review platforms should have been collected over time, not all in one week, and should mention concrete details. A burst of five star reviews with no specifics is weaker evidence than a smaller number of detailed ones.

Signal 8, how the business answers complaints. Read the replies to negative reviews. Specific, calm answers and offers to fix problems show a business that expects to be around next year. Silence or hostility is worth noting, especially when the complaints come from suppliers.

Signal 9, what other vendors say. For a service provider this matters more than consumer reviews. Look for mentions by freelancers, agencies and contractors of late payment, disputed invoices or walked away projects. ClientVetter members can search evidence-backed non paying clients reports, each shown with the reported company's reply and hidden while any dispute is under review.

Compliance signals ten to twelve

Signal 10, the court record. Search the company name in public court indexes such as PACER for federal cases and the court portal of the state where it operates. One lawsuit means little. Repeated collection actions, judgments or mechanics liens filed by different vendors over a short period form a pattern.

Signal 11, licenses where the work requires them. Contractors, real estate businesses, staffing firms and many regulated services need state or local licenses that are publicly searchable. A client in a licensed trade with no license on record is a gap worth asking about.

Signal 12, a clean sanctions screen. All US persons must avoid dealings with parties on the OFAC Specially Designated Nationals list and similar government lists. Screen the business name and the principals you deal with in their business role, particularly for international clients and payments routed through foreign accounts.

How to weigh a mixed result

Real businesses rarely score perfectly. A two person startup will have a young entity, a young domain and no reviews, and it may still pay on time every month. What you are looking for is consistency between the signals and the story, and an absence of the patterns that predict non-payment.

• All twelve signals look healthy: standard terms are reasonable.
• Young or thin footprint but no negative signals: ask for a deposit and bill by milestone.
• Conflicting identity signals: request documents before any work starts.
• Vendor complaints, judgments or an inactive status: insist on payment in advance or decline.

A thin footprint is a signal on its own, not a reason to panic. It simply means you are carrying more of the risk, and your terms should reflect that. This is general business guidance, not legal advice.

Keeping the check current after you say yes

A business that was healthy at signing can change. Entities fall out of good standing when annual reports are missed, domains lapse, and new vendor complaints appear months into a relationship. If you work with clients on retainers or long payment terms, rechecking the identity and reputation signals every few months is cheap insurance. ClientVetter business credit monitoring watches registry status, domain records and member reports for the clients you choose and emails you when something changes.