To check if an international company is legitimate, work through a short sequence of independent checks before any money moves: confirm the entity in its home country’s corporate registry, screen it against U.S. sanctions and restricted party lists, pull a credit report, validate its tax or VAT number, verify any certificates it claims, and look at its physical address and domain history. Each check answers a different question, and a gap in any one of them is where fraud tends to live. Most of these tools are free or low-cost, and you can finish the work online before sending a wire.
Confirm the Company in Its Home-Country Registry
A company that legally exists appears in its home country’s corporate registry. That filing reflects official record, not self-reported claims, and it will show whether the entity is active, dissolved, or in liquidation, along with its incorporation date and the officers authorized to act for it.
For any EU member state, the Business Registers Interconnection System pulls real-time data from each national registry through the European e-Justice Portal and lets you search by name across all 27 member states plus Liechtenstein and Norway.1European e-Justice Portal. Business Registers Interconnection System (BRIS) Search In the United Kingdom, Companies House gives free access to filing history, current status, and registered officers.2GOV.UK. Companies House China publishes registration details, business anomaly flags, and records of serious legal violations through the National Enterprise Credit Information Publicity System, though the interface is in Mandarin.3State Administration for Market Regulation. National Enterprise Credit Information Publicity System Canada’s Business Registries covers federally incorporated companies and most provinces including Ontario, British Columbia, Quebec, and Alberta.4Canada’s Business Registries. Canada’s Business Registries Australia uses ASIC Connect for companies registered with the Australian Securities and Investments Commission.5ASIC. Search Company and Other Registers India’s Ministry of Corporate Affairs runs a company search portal at mca.gov.in.
Look at three things in the record. Compare the incorporation date to the experience the company claims. A firm claiming twenty years in the industry with a six-month-old registration needs to explain that gap. Check that the legal name on the registry matches the name on the invoice and contract exactly. And look for a stable filing history without sudden director changes right before you were contacted.
Screen Against U.S. Sanctions and Restricted Party Lists
For U.S. persons, this step is a legal requirement, not just good practice. The Office of Foreign Assets Control maintains the Specially Designated Nationals and Blocked Persons List, and U.S. persons are prohibited from transacting with anyone on it and must block any property in which an SDN has an interest.6Office of Foreign Assets Control. Specially Designated Nationals (SDNs) and the SDN List OFAC’s free Sanctions List Search lets you query by name, country, or program with adjustable fuzzy matching.7U.S. Department of the Treasury. Sanctions List Search Civil penalties under the International Emergency Economic Powers Act can reach $377,700 per violation, and penalties under the Foreign Narcotics Kingpin Designation Act can exceed $1.8 million.8Federal Register. Inflation Adjustment of Civil Monetary Penalties
OFAC’s list is not the only one that matters. The Bureau of Industry and Security keeps separate lists for denied persons, unverified end-users, and entities subject to export restrictions. The Consolidated Screening List on trade.gov searches all U.S. government restricted party lists in one query.9International Trade Administration. Consolidated Screening List A hit on the Denied Persons List means dealings that would violate the denial order are prohibited outright. A hit on the Unverified List is a formal red flag that requires additional due diligence before proceeding.10International Trade Administration. CSL Search Run these searches before every new transaction. Companies get added without warning.
Pull a Credit or Risk Report
The registry confirms a company exists. A credit report tells you whether it pays. Those are separate questions, and the second matters just as much when you’re about to extend trade credit or ship before receiving payment.
Dun & Bradstreet assigns a unique nine-digit D-U-N-S Number and maintains credit files on more than 600 million companies worldwide, aggregating payment behavior data on whether a firm pays vendors on time, pays late, or defaults.11Dun & Bradstreet. What Is a D-U-N-S Number? Experian sells international business credit reports covering the U.S., Canada, the UK, and dozens of other countries, starting at $59.95 for a basic score and $69.95 for a fuller profile.12Experian. Business Credit Report – Run a Free Company Search Equifax offers a Business Failure Score that estimates the likelihood of bankruptcy within the next twelve months.13Equifax. Business Credit Reports
These reports also surface public records that rarely show up in a government registry: liens, court judgments, and legal disputes. An active judgment or a pattern of unpaid debts is a preview of how your invoices will be treated. A report showing no assets, no payment history, and no trade references is a company that exists on paper but may not exist commercially.
Validate the Tax or VAT Number
A legitimate cross-border company will have a tax identification number issued by its home government. In the EU that takes the form of a VAT number beginning with a two-letter country code followed by a block of digits whose length varies by country.14Taxation and Customs Union. VAT Identification Numbers Elsewhere the identifier is a GST number or a general Tax Identification Number, depending on local law.
Collecting the number isn’t the check. Validating it is. The European Commission runs VIES, the VAT Information Exchange System, which confirms in seconds whether a VAT number is valid and active.15European Commission. VIES VAT Number Validation If the number comes back invalid, the company either fabricated it or lost its registration, and either answer should stop the transaction. Non-EU tax numbers usually have to be checked directly on the issuing country’s tax authority website, since there is no single global validator.
Verify Certificates and Official Documents
ISO Certificates
An ISO 9001 certificate attached to an email proves nothing by itself. It’s meaningful only when issued by an accreditation body recognized by the International Accreditation Forum. IAF CertSearch is a free global database where you enter a company name and confirm whether its ISO certification is legitimate, who issued it, and what scope it covers.16IAF CertSearch. IAF Certification Validation The system cross-checks accreditation body data against certification body records, so a certificate issued by a non-accredited body won’t appear. If the company isn’t in the database, ask why before you proceed.
Certificates of Good Standing
A Certificate of Good Standing, or its local equivalent, confirms a company is current on its filings and taxes in its home jurisdiction. You can ask a prospective partner to provide one, but verifying its authenticity means understanding how international document authentication works.
For countries that are parties to the 1961 Hague Convention, official public documents are authenticated through an apostille, a standardized certificate that replaces old-style consular legalization by certifying the signature and seal on the document.17HCCH. Convention of 5 October 1961 Abolishing the Requirement of Legalisation for Foreign Public Documents The convention covers administrative documents, notarial acts, and official certificates placed on privately signed documents. It does not cover documents dealing directly with commercial or customs operations, so a customs declaration or shipping manifest needs a different form of verification. If the company’s home country isn’t a Hague signatory, the document needs full consular legalization, which takes longer and costs more.
Check the Physical Address and Domain History
Drop the registered address into satellite imagery. It takes thirty seconds. If it resolves to a residential house, a mailbox rental store, or an empty lot, you need a convincing explanation before moving forward. Legitimate manufacturers work out of industrial zones. Legitimate trading companies operate from commercial office space. A mismatch between the stated industry and the visible premises is a reliable warning.
Domain lookups are less useful than they used to be. Since January 2025, ICANN has fully transitioned from WHOIS to the Registration Data Access Protocol for generic top-level domains.18ICANN. ICANN Update: Launching RDAP; Sunsetting WHOIS Under GDPR and similar privacy laws, registrant names, emails, phone numbers, and addresses are routinely redacted from public results for domains tied to individuals in the EU. ICANN’s free Registration Data Lookup Tool still shows the creation date, expiration date, and sponsoring registrar.19ICANN. WHOIS and Registration Data Directory Services The creation date is still worth pulling. A company claiming decades of experience whose domain was registered three weeks ago deserves scrutiny, and a registrar or hosting country with no connection to the company’s claimed location is worth investigating.
Watch for Payment-Instruction Fraud After You’ve Verified
Even after a company clears every check, the transaction can be hijacked. Business Email Compromise is one of the most common and costly forms of international fraud, and it works because the target has already decided the counterparty is legitimate.
The FBI flags several patterns in international B2B communications:20Federal Bureau of Investigation. Business Email Compromise
- An invoice from a familiar vendor suddenly lists a new bank account or mailing address. This is the single most common attack.
- The sender’s email address differs from the real contact by one character: an extra letter, a swapped digit, a slightly different domain.
- The requester insists you act immediately, citing a time-sensitive deal or a problem that must be resolved before close of business.
- Wire instructions arrive only by email, especially for a large down payment.
Verify any change in payment instructions by calling a known phone number for the company, not a number provided in the suspicious email. Criminals who have quietly gotten into an email thread time their fraudulent messages to real billing cycles so the request reads as routine.
Structure the First Transaction to Limit Exposure
Verification lowers risk. It doesn’t eliminate it. How you structure the first few transactions matters as much as the research you did beforehand. Wiring full payment upfront to a company you’ve never worked with, however clean its filings look, is the most common way small businesses lose money in international trade.
A letter of credit is the standard protection. Your bank commits to paying the seller, but only after the seller presents documentation showing the goods were shipped as agreed.21International Trade Administration. Letter of Credit The bank acts as an intermediary neither side can easily defraud. Letters of credit cost more than a wire, but the cost is trivial next to losing a full shipment’s payment.
For smaller orders where a letter of credit is overkill, start with a trial. Pay a modest deposit, receive the goods, inspect them, and scale up from there. A legitimate seller understands the approach because they face the same risk from new foreign buyers that you face from them. A company that refuses any structure other than full wire upfront, especially one also pressuring you to move quickly, is waving every red flag at once.