To verify if a business is legitimate, run its name through five free public sources before you send any money: the state business registry where it operates, the licensing board or federal regulator for its industry, a quick address and phone check, its online footprint, and consumer complaint databases. Each source checks a different layer, and skipping one leaves a gap that dishonest operators know how to use. Most of the work takes under an hour.
Start With the State Business Registry
Every state keeps a free, searchable database of corporations, LLCs, and partnerships formed or registered inside its borders, usually on the secretary of state’s website. Type in the company name and you get the legal name, formation date, registered agent, and current status.
Check the status first. “Active” or “In Good Standing” means the company has kept up with its filings and fees. “Administratively Dissolved” or “Revoked” means it may no longer have legal authority to do business.
Compare the formation date against whatever the company claims about its history. A business marketing twenty years of experience but incorporated two years ago isn’t automatically lying — it may have restructured — but the gap deserves a direct question. The record also names the registered agent, the person or service designated to accept legal papers. Many legitimate companies use professional registered agent services at a different address, so an address mismatch there is not a problem by itself. No registered agent at all is.
Businesses operating under a name different from their legal entity name generally have to file a trade name or “Doing Business As” registration. If someone tells you the company is “Bright Path Consulting” but the state only lists “J. Smith Holdings LLC,” the DBA filing is the bridge between those two names. No DBA on file for the name a company uses publicly means a basic legal step is missing.
One catch trips people up: a business only appears in the state where it was formed or where it registered as a foreign entity. A Delaware LLC operating in Texas should show up in both states. If it only appears in Delaware and hasn’t foreign-qualified where it’s actually working, it may face penalties and could even be barred from enforcing contracts in that state’s courts. Search the registry in the state where you’d be dealing with the company, not just its home state.
Verify Professional Licenses and Regulatory Records
Legal registration proves the business exists on paper. It says nothing about whether the business is qualified to do what it claims. Construction, healthcare, financial services, and law all require practitioners to hold valid licenses issued by state or federal boards, most of which publish searchable directories where you can confirm a license number, its expiration date, and any disciplinary actions.
Financial services have especially strong public records. Broker-dealers and their individual representatives must register with both the Securities and Exchange Commission and the Financial Industry Regulatory Authority.1U.S. Securities and Exchange Commission. Guide to Broker-Dealer Registration FINRA’s free BrokerCheck tool at brokercheck.finra.org shows employment history, licensing, regulatory actions, arbitrations, and customer complaints for any registered firm or individual.2Financial Industry Regulatory Authority (FINRA). BrokerCheck If someone is selling you an investment product and doesn’t appear in BrokerCheck, walk away.
For nonprofits, the IRS Tax Exempt Organization Search lets you confirm that an organization actually holds tax-exempt status and verify its Employer Identification Number.3Internal Revenue Service. Tax Exempt Organization Search A legitimate 501(c)(3) will be in that database. If a charity soliciting donations isn’t, your gift may not be deductible and the organization may not be what it claims.
Federal safety records show how a business actually operates. OSHA’s Establishment Search covers over three million workplace inspections conducted since 1972, updated daily, and returns inspection dates, cited standards, and whether cases are open or closed.4Occupational Safety and Health Administration. Establishment Search A contractor with repeated OSHA violations is telling you something a clean license record won’t. For trucking and transportation companies, the Federal Motor Carrier Safety Administration runs a comparable carrier search that includes insurance filings and safety records.5Federal Motor Carrier Safety Administration (FMCSA). Licensing and Insurance Carrier Search
Check the Physical Address and Phone Number
The address a company gives you should match what it has filed with government agencies. Pull the listed address up on satellite imagery and see whether it’s an office building, a storefront, a house, or a vacant lot. Commercial zoning restrictions in most jurisdictions make a full-service headquarters at a suburban home an obvious question about scale.
Virtual offices and P.O. boxes aren’t automatic disqualifiers. Small or remote businesses use them for mail handling all the time. What matters is whether the company’s presentation matches its actual infrastructure. A virtual address in a premium zip code can make a one-person operation look like a major firm, and that’s exactly the point of it. The distinction matters most when you’d need to serve legal papers, return defective goods, or visit in person.
Phone numbers deserve a quick check too. A legitimate business usually answers with its company name, keeps consistent contact information across its website, government filings, and directory listings, and has a working line that doesn’t route only to voicemail. Mismatched addresses or phone numbers across records aren’t proof of fraud, but they’re reason to keep digging.
Read the Online Footprint Carefully
WHOIS lookups used to reveal the name, address, and contact information of whoever registered a website’s domain. Since GDPR enforcement and the spread of privacy protection services at domain registrars, most WHOIS queries now return “Redacted for Privacy” or a generic proxy instead. You can still see when a domain was first registered, and a brand-new domain for a company claiming decades of experience is worth flagging. Just don’t expect WHOIS to tell you who actually owns the site.
The padlock icon in the browser address bar means the connection is encrypted. It does not mean the business is legitimate. A basic Domain Validation certificate produces the padlock and only proves someone controls the domain — no verification of identity, address, or legal existence. Any scammer can get one in minutes for free. Higher-assurance certificates do verify the business, but browsers no longer display them any differently in most cases. The padlock protects your data in transit, nothing more.
What actually helps is consistency across the whole digital footprint. Does the website’s address match what’s in the state registry? Does the domain’s age fit the company’s claimed history? Are the social media profiles genuinely established, with a track record of real engagement, or were they all created last month? Scam operations can build a polished homepage. They usually can’t fake years of archived posts, customer interactions, and third-party mentions.
Look Up Complaints and Financial Filings
Government registries tell you a business is legally real. Complaint databases tell you how it treats people. The Better Business Bureau assigns letter grades from A+ to F based on complaint volume, how the company responds, and whether it resolves complaints. You can search any business free at bbb.org, and a low grade or a pattern of ignored complaints reveals more about reliability than any marketing page will.
The Federal Trade Commission collects consumer fraud reports through ReportFraud.ftc.gov and feeds them into the Consumer Sentinel Network used by law enforcement nationwide.6Federal Trade Commission. Consumer Sentinel Network Consumer Sentinel isn’t directly searchable by the public, but the FTC publishes data books and spotlights on common scam patterns and entities with significant complaint histories.7Federal Trade Commission. Scams – Consumer Advice Your state attorney general’s office may also maintain a searchable consumer complaint database, and filing there creates a record other consumers and investigators can eventually see.
If the company is publicly traded, the SEC’s EDGAR database gives you free access to its annual reports (Form 10-K), quarterly reports (Form 10-Q), and current reports (Form 8-K) disclosing material events.8U.S. Securities and Exchange Commission. EDGAR Full Text Search Those filings carry audited financial statements, risk disclosures, and executive compensation details.9U.S. Securities and Exchange Commission. Using EDGAR to Research Investments A company that claims strong financials but hasn’t filed with the SEC, or whose filings show mounting losses and regulatory investigations, is telling you two different stories.
Pay in a Way That Protects You
How you pay matters as much as who you pay. Credit cards carry the strongest consumer protections. Under the Fair Credit Billing Act, you have 60 days after receiving a billing statement to dispute charges for undelivered goods, incorrect amounts, or unauthorized transactions.10Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors The card issuer must investigate and cannot try to collect the disputed amount while the investigation is pending. Wire transfers, cryptocurrency payments, and gift cards offer no comparable protections. A business that insists on those methods is waving a red flag the size of a billboard.
Before a large purchase or a signed contract, ask for references from past clients and check whether the business carries appropriate liability insurance. For contractors and service providers, ask for a certificate of insurance and call the carrier on it to confirm the policy is active. Any legitimate business will accommodate these requests without hesitation. A company that gets defensive when you ask for verifiable credentials is telling you something it probably didn’t intend to.