How to Check if a Business Is Legitimate: 9 Checks That Take Under 10 Minutes

Short answer: most fake businesses fail at least one of three checks, and all three are free. Look the company up in your state's business registry, check how old their website domain is, and look at how they want to be paid. Those three take about three minutes between them. The other six below take another seven, and together they catch almost everything that can be caught from a desk.

None of this requires a paid tool or a subscription. Every lookup in this article is either a government service or something your browser already does.

When these checks are worth running

You do not need to investigate the corner shop. These checks are for the situations where money moves before you can judge the work.

Before paying a deposit to a contractor you have not used before. Before a large order from an online retailer you have never bought from. Before signing with a vendor or supplier. And any time a company contacts you first, because unsolicited contact is the one thing almost every impersonation scam has in common.

Be clear on what you are testing. These checks tell you whether a business is real, registered and trading under the name it claims. They tell you nothing about whether it is any good, which is a separate question covered at the end.

The 9 checks

1. Search your state's business registry (2 minutes)

Every US state publishes a searchable register of businesses incorporated there. You are looking for three things: that the company exists under the name it gave you, that its status reads Active or In Good Standing, and when it was registered.

One warning before you search, because it matters more than the search itself. Type "[your state] secretary of state business search" into Google and most of the first page will be private companies, not your state government. When I ran that search for California while writing this, the results included secretaryofstate.org, secretaryofstateusa.com, sosbusinesssearch.com, entitysearch.us, corpsearch.org and businesssearch.org. Not one of those is the California Secretary of State. Several charge for information the state gives away.

Check the domain ends in .gov before you click. Official state registries are on .gov addresses. If it is .com or .org, you are on a reseller.

Pass: the entity exists, status is Active or In Good Standing, and the registration date is consistent with how long they say they have been trading.

Fail: no record at all, a status of Dissolved, Suspended or Forfeited, or a company claiming fifteen years of experience that registered eleven weeks ago.

One nuance. A business can be registered in one state and legitimately operate in another, so search the state they say they are based in. If you cannot find them anywhere, that is the finding.

2. Check the professional licence (2 minutes)

Contractors, electricians, plumbers, real estate agents, insurance brokers, lawyers and medical providers generally cannot trade without a licence. Each state runs a board that publishes a searchable register, and the same .gov rule applies.

Search the licence number they gave you rather than the business name, if you have it. Numbers are harder to fudge than names.

Pass: the licence number matches the business or individual named, the status is current, and there is no open disciplinary action.

Fail: no record, an expired licence, or a number that comes back registered to somebody else. That last one happens more than people expect, because borrowing a real licence number is easier than obtaining one.

As the California Attorney General's guidance on checking a business background puts it, many trades simply cannot operate without being registered with a government agency or industry body. If the trade requires a licence and they cannot produce one, the conversation is over.

3. Check how old the website is (30 seconds)

A WHOIS lookup shows when a domain was first registered. ICANN runs a free one, and so do most registrars.

This is the fastest contradiction to find in the whole article. A company advertising twenty years of experience on a domain registered in March is telling you something, and the domain is not the part that is lying.

Pass: registration date roughly matches the trading history they claim.

Fail: a domain registered within the last few months, attached to claims of long experience.

Two honest caveats. Established businesses rebrand and buy new domains, so a young domain is a question rather than a verdict. And privacy-protected registration, where the owner's details are hidden, is completely standard and is not a red flag by itself.

4. Look at the address on a map (1 minute)

Paste the address into a maps service and switch to satellite or street view.

You are checking whether the address exists and whether it matches the business. A commercial landscaping firm with a yard full of machinery should not be registered to a third-floor flat. A company claiming a large operation at an address that turns out to be a mailbox store is worth a question.

Pass: the address exists and the building is plausible for the type of business.

Fail: the address does not exist, or the building is obviously unrelated to the work.

Be fair here. Virtual offices, co-working addresses and home-based businesses are all entirely legitimate, and plenty of excellent tradespeople run from a van and a spare room. This check is a prompt to ask a question, not a disqualifier on its own.

5. Reverse image search their photos (1 minute)

Right-click any image on the site and search it. Try the team photos, the premises, the portfolio work and the product shots.

A hit here is unusually strong evidence, because it indicates deliberate deception rather than carelessness. Nobody accidentally uses a stock photo of a stranger and labels it with their own name, or presents another company's completed work as their portfolio.

Pass: images do not appear elsewhere, or appear only on the company's own social accounts.

Fail: the team page is stock photography, or the portfolio belongs to someone else.

6. Read the reviews for pattern, not score (2 minutes)

The average rating is the least informative number on the page. Look at four other things.

Distribution over time. Twenty reviews spread across three years reads differently from twenty posted in a fortnight.

Reviewer history. Accounts with one review each, no photo and no other activity are weak signals individually and a strong one in aggregate.

Whether the detail matches the business. A review praising the paintwork on an engine reconditioning company suggests the review, the listing, or both are wrong.

Whether criticism gets answered. How a business behaves when someone is unhappy is the thing you are actually trying to predict.

A thin or suspiciously uniform review profile is not proof of anything on its own, but combined with a young domain and no state registration it stops being a coincidence. We covered the patterns that bought reviews leave behind in why buying reviews backfires, which is useful background if something about a profile feels off and you cannot name why.

7. Test the contact methods (30 seconds)

Call the number. Does it connect, and does whoever answers say the company's name?

Check whether a physical address and a phone number appear anywhere on the site at all. Check whether the email is on the company's own domain rather than a free webmail account.

Pass: phone connects and is answered properly, address and contact details are published.

Fail: disconnected number, no address anywhere, contact only through a web form.

Caveat worth keeping in mind: small and new businesses sometimes use webmail perfectly innocently. Weigh it with everything else rather than on its own.

8. Check complaint history (30 seconds)

Two quick searches. Look the company up on the Better Business Bureau, and search its name alongside the words "scam" or "complaint".

The California Attorney General's guidance names the BBB specifically for this purpose. Two things to know while you read it. No BBB profile at all is common and is not a problem in itself. And BBB accreditation is a paid programme the business opts into, so the badge tells you they paid, not that they are good.

9. Look at how they want to be paid (30 seconds)

This is the check that matters most if you only have thirty seconds, because it is the one that decides whether you can get your money back.

Requests for payment by wire transfer, gift cards, cryptocurrency, payment apps or cash only are the common thread running through the FTC's guidance on spotting and reporting imposter scams. Those methods are chosen because they are difficult or impossible to reverse.

Add urgency to the mix and the signal gets stronger. A deposit that must be paid today, by wire, to secure a price that expires tonight, is not a pricing strategy.

Pass: they accept cards, and they are relaxed about which method you use.

Fail: one irreversible method only, pressure to use it, or a payee name that does not match the business.

The 10-minute version

If you only have three minutes, run 1, 3 and 9.

What to do when something fails

Most people will not find an obvious fraud. They will find one ambiguous result, and the useful question is whether it is a flag or a dealbreaker.

One flag usually warrants a question, not a walk-away. A young domain, a virtual office address or a thin review profile each have innocent explanations. Ask directly: "I could not find you on the state register, which company name are you registered under?" An established business answers that in one sentence without taking offence. Evasion, irritation or a change of subject is itself the answer.

A combination is where you stop. No state registration, plus a domain registered this year, plus pressure to pay by wire, is not three coincidences. You do not need certainty to walk away from a transaction that has not happened yet.

If you have already paid and something is wrong, act in this order. Contact your bank or card issuer immediately, because time limits apply to disputes. Report it to the FTC. Contact your state attorney general's office. If a trade licence was involved, report it to the licensing board, which has powers the other agencies do not.

Report it even if you lost nothing. Complaint data is how patterns get spotted, and the business that pressured you today will pressure someone else tomorrow.

What these checks cannot tell you

Worth being honest about the limits, because a clean pass on all nine proves less than it feels like it does.

Registration means a company filed paperwork and paid a fee. It does not mean they are solvent, competent, insured, or that they will turn up on Tuesday. Plenty of properly registered businesses with active licences and genuine reviews still do bad work.

These checks are built to catch fabrication, not to measure quality. For quality, you need the things that take longer: references you actually call, a written estimate that itemises parts and labour, proof of insurance, and ideally some work you can go and look at.

Think of the ten minutes as clearing the floor. It tells you the business is real. What they are like to deal with is the next conversation.

Before you pay

Three checks catch most of it. Look them up on your state's .gov registry, check the domain age, and look at how they want the money.

That is three minutes. The other six take seven more, and the whole exercise costs nothing except the ten minutes you were going to spend worrying anyway.