How to Tell if a Business Is Legitimate, and How a New Business Looks Credible

Telling whether a business is legitimate works the same way from both sides of a deal. You check a new supplier with low prices before you send a deposit. A larger customer checks your new company before signing. Both of you look at the same public sources, and on one side a deposit is at risk, on the other a deal.

To check whether a business is legitimate, you combine several sources. Start with the state business registry to confirm the company exists and is active. Then verify any required license with the agency that issued it. After that, compare reviews, complaint records and the address. Look at the website and at the way the company asks to be paid.

The California Attorney General's consumer guide makes the same point: no single resource fully verifies a company. The customer checking you will run the same checks, so everything you learn about the supplier also shows you what they'll see about you.

Before the first deposit: what each credibility check tells you

You start with the supplier. A company can be properly registered and still be an unreliable partner. And an honest company can be too young to have a single review. So it helps to treat each check as the answer to one narrow question.

The state registry is usually the Secretary of State. You check a license with the agency that issued it. The IRS EIN notice is the CP 575. Enforcement records come from the Attorney General, the FTC and the courts.

The last row explains a lot about how careful people check. A well-made website costs money and skill. But it proves nothing about the people behind it. That's why careful checkers give more weight to signals that take time and real activity to build.

Checking a supplier's credibility, one source at a time

How far you go depends on what's at stake. A person buying a small item checks less than a company about to send a deposit or offer payment terms. With a deposit on the line, you run the full set.

Registration and status

Every LLC and corporation is registered with a state office, usually the Secretary of State. Its business search shows whether the company exists and whether its status is active. Some states have extra status records.

In Texas, for example, the Comptroller's Franchise Tax Account Status shows whether an entity has the right to transact business in the state. If that right is forfeited, the entity "will be denied the right to sue or defend itself in a Texas court". A forfeited or inactive status is visible to anyone who looks.

Licenses

Some activities need a license from a state or local agency. For those, the California Attorney General advises verifying the license directly with the agency that issued it. Say the supplier prints a license number on its website. You check that number against the agency's records, and that comparison is the real test.

Reviews on several platforms

Reviews show how a business treats customers, including when something goes wrong. Reading them on more than one platform gives a fuller picture. Commerce Bank's 2026 guide to fake companies lists overly positive reviews, repetitive reviews and reviews posted within a short period as a warning sign. Google's review policy requires reviews to reflect a genuine experience. It prohibits paid and incentivized reviews.

The BBB profile

Next you look the supplier up on the Better Business Bureau site. Its Business Profiles are free. Each one shows a company's rating, accreditation status, reviews and complaints. Ratings run from A+ to F on a 100-point scale. A+ covers 97 to 100, and F covers 0 to 59.99.

The BBB builds the rating from seven elements:

• complaint history
• type of business
• time in business
• transparent business practices
• failure to honor commitments to the BBB
• licensing information
• advertising issues

The BBB calls the rating its opinion. It says "a rating is not a guarantee of a business's reliability or performance."

People often get a few points about the BBB wrong, and they matter when you read a profile:

• It's a private organization with no regulatory power.
• Accreditation is voluntary and requires meeting BBB standards.
• It also requires at least six months of serving customers.
• Accredited businesses pay dues, but the BBB says "accreditation dues do not buy a rating."
• An "NR" status "is not a grade, and it is not negative."
• Not being accredited isn't, on its own, a mark against a business.

Website and domain

Then you open the supplier's website. The California Attorney General suggests looking for broken links, stock photos and vague privacy or terms pages. It also suggests checking the date the domain was registered. A recently registered domain isn't evidence of fraud by itself. But a careful checker will notice it and look harder at the other signals.

Complaints, lawsuits and enforcement

Search the company name together with words such as "reviews", "scam" and "lawsuit". That brings up most public complaints. State Attorneys General and the Federal Trade Commission (FTC) publish enforcement actions. No record is a reasonable sign, though it can't guarantee anything.

The address

You also look at whether the address exists and whether the company actually uses it. A business doesn't need a large office. But the address should be real and match what the company says about itself.

How the company asks to be paid

Finally, the deposit itself. Payment terms say a lot about a counterparty. The California Attorney General notes that paying by credit card or PayPal gives the buyer more protection than cash or a check. It also advises getting the terms in writing before paying.

When the offer looks too good: imposter scam warning signs

Cheap prices and a request for money upfront are exactly the setting where imposter scams work. FTC data released on June 15, 2026 show people reported losing $3.5 billion to imposter scams in 2025. Business impersonators took nearly $1 billion of that, up from $866 million in 2024. Nearly one in three fraud reports involved imposter scams. Total reported fraud losses were about $16 billion in 2025, roughly 25% higher than in 2024.

Commerce Bank's guide and the California Attorney General's page describe similar warning signs:

1. pressure to act immediately
2. an offer that seems too good to be true
3. requests for payment by gift card, cryptocurrency or wire transfer
4. unexpected requests for personal information
5. no physical address, or only a contact form
6. spelling errors and names that don't match across documents
7. a polished copy of a real brand's website
8. reviews that are overly positive, repetitive or posted in a short window

That note applies to you as well. A new, honest business may still have no reviews, no BBB profile and no credit file.

The customer asks about your credit

Now the other side. Your new customer wants to pay you after delivery, so their finance team runs a business credit check. It answers a narrower question: does this company pay its bills? Suppliers and lenders usually run it before they offer payment terms.

The SBA explains how this differs from personal credit. Personal credit is tied to a Social Security number. Business credit is tied to the company's EIN or its D-U-N-S number, and each business entity can have its own credit identity.

There's no single scoring model either. The SBA names FICO SBSS, Paydex and Intelliscore, plus the Small Business Credit Risk Score.

Experian's score draws on:

• payment habits and credit use
• public records such as liens, judgments and bankruptcies
• company details such as years on file, industry code and size

Experian says it holds verified data on more than 30 million businesses. Anyone can search by company name, Experian business ID or tax ID.

Creditsafe publishes its score bands. The score predicts serious delinquency or bankruptcy within the next 12 months. Serious delinquency means 90 or more days beyond terms.

Besides the score, a Creditsafe report shows details a customer can compare with what you've told them:

• the registered address
• the Secretary of State number
• group structure and ultimate owners
• payment trends
• any liens, judgments or bankruptcies

Looking up your own "EIN credit score"

So you try to see your own score for free. Many people search for a free credit score tied to an EIN. But no single score like that exists, because each bureau uses its own model. Free access is limited. Bank of America, for example, gives its business clients free access to a Dun & Bradstreet score. Viewing it doesn't affect the company's credit.

A D-U-N-S number is a nine-digit identifier from Dun & Bradstreet. According to SCORE, free registration may take up to a month. A paid expedited option takes 1 to 5 days. D&B then builds a PAYDEX score on a 1 to 100 scale.

You may find your company has no file at all. A brand-new company with no payment history often doesn't. That's a normal stage for a young business, and it's different from a poor score.

Running a credibility check on your own company

Now you search for your own company the way the customer will. In our work with clients, we see partners checking young companies more and more through AI tools and the Google profile. They also read reviews on Google, Trustpilot and similar platforms. When those searches return very little, the partner has less to base a decision on.

The signals a checker hopes to find on a new business include:

• a registered company in active status
• proof of the EIN, such as the IRS CP 575 notice
• licenses and insurance where the trade requires them
• a real business address that meets platform rules
• a Google Business Profile, if you serve customers in person or at their location
• listings in relevant directories
• a website or landing page with contact details, an About page and privacy and terms pages
• active social media pages
• reviews from real customers, collected within platform rules
• mentions in the press or other third-party sources

The customer may ask for proof of your EIN first. The CP 575 notice is the IRS confirmation of an EIN. You can get a digital CP575 through the IRS Business Tax Account. The IRS says banks and other institutions accept it "as written confirmation of an entity's EIN". The original paper notice "cannot be duplicated or recreated", so store it safely.

On the website side, Google's guidance on helpful content says "trust is most important" among the qualities it describes. It recommends clear authorship and About-page information. Google also says E-E-A-T "isn't a specific ranking factor" in itself. E-E-A-T stands for experience, expertise, authoritativeness and trust.

Our overview of how these pieces fit together is in What Is an Online Presence and What Does a Small Business Need. Directories are covered in Business Directories Explained: Which Listings a New Business Needs and Why.

Marketing blogs often use the phrase "AI trust signals". We've found no official public source that explains which signals AI assistants use to choose or cite a business. So we don't claim to know. What we can say is that the public signals above are the same ones a human checker sees.

The BOI report you may see on old lists

Some older guides list a filed BOI (beneficial ownership information) report as a sign of a compliant company. FinCEN's BOI page has an alert updated on August 11, 2026. It says a final rule effective August 14, 2026 exempts US companies from BOI reporting.

The remaining reporting companies are foreign entities registered to do business in a US state. New foreign registrants file within 30 days. So for a US company, a filed BOI report tells a checker nothing.

Why your company looks empty

Your search probably turns up less than you hoped. An honest new company often looks thin to a checker for ordinary reasons:

1. It has served few customers, so there are few reviews.
2. Credit bureaus score payment history, and it has no trade accounts to score.
3. Its domain is new, and the registration date is public.
4. BBB accreditation needs six months of serving customers, so it can't have it yet.
5. The address may be one Google won't accept for a Business Profile.

The virtual address and Google's rules

The last reason surprises many owners. Using a virtual address for company mail is legal. But Google's rules for Business Profiles are strict:

• A profile must be "for your actual, real-world location."
• A rented mailing address you don't operate from "isn't eligible."
• Service-area businesses can't list a virtual office unless it's staffed during business hours.
• "P.O. boxes or mailboxes located at remote locations aren't acceptable."
• A co-working office needs clear signage, customer visits during business hours and the company's own staff.

So a company can be fully legal at a virtual office and still be unable to get a Business Profile at that address. Google also requires the profile name to match the real-world business name. And you get one profile per business. The name can't include taglines, URLs, phone numbers or hours.

Address types are compared in Virtual Address vs PO Box vs Physical Address: Which Can Your Business Use. The profile itself is explained in What Is a Google Business Profile and Why a New Business Needs One.

The shortcut someone will offer you: bought reviews and followers

When your business looks empty, buying reviews or followers can seem like a quick fix. Sellers will offer them, often cheaply. But the FTC's Consumer Reviews and Testimonials rule makes that a legal risk. It's been in effect since October 21, 2024, and it covers:

• fake or false reviews (16 CFR 465.2)
• buying reviews that must express a particular sentiment (465.4)
• suppressing reviews through groundless legal threats or intimidation (465.7)
• fake social media indicators such as followers or views from bots (465.8)

The rule applies where the business knew or should have known. Courts can impose civil penalties for knowing violations. The FTC's maximum civil penalty amount was $53,088 as of January 17, 2025. Hosting customer reviews on your own website is generally exempt.

In December 2025 the FTC sent warning letters to businesses. They said fake reviews or rewards for only positive reviews "may trigger enforcement actions and fines."

Google's policy adds its own limits. It prohibits:

• paid reviews
• multiple reviews from one person using several accounts
• reviews rewarded with payment, discounts or free goods
• asking only happy customers for reviews (known as review gating)
• content with a conflict of interest, such as reviews of your own business

Doing it yourself or hiring help

Building these signals involves several pieces of work: company formation, a Google Business Profile, directory listings and a website. Social media pages and press releases come on top. Each one has its own rules, review process and waiting time.

Doing the work yourself costs less money and more time. Mostly that's because you need to learn each platform's rules on addresses, names and reviews. A single mistake there can get a profile rejected or suspended.

Hiring help saves that time and cuts rule-related errors. It makes the most sense when:

1. the business already takes all your time
2. you live outside the US
3. you want all the pieces set up together

Our team does this work for new companies launching in the US. We register the LLC, set up the Google profile and build the listings around it.

No provider controls Google, the BBB or the credit bureaus. So a guarantee of results in those systems is a promise nobody can keep. Some signals also take their own time, whoever does the work. Reviews come from customers, a credit file comes from payment history, and BBB accreditation requires six months of serving customers.

What to do this month

Before you send money to any new supplier, check the state registry and the license, then read reviews on more than one platform. Pay by a method that protects you, and get the terms in writing.

Then run the same checks on your own company. Start with what's hardest to fix later:

• your status in the state registry
• a safe copy of your CP 575 notice
• whether your address is one Google accepts

After that, ask real customers for reviews and pay your first suppliers on time, so a credit file can start. Turn down anyone selling reviews, followers or guaranteed results. If you live outside the US or use a virtual address, get help before a profile is rejected.