How do I check if a company is legitimate?

Verify the company through independent sources rather than the materials it gives you. Confirm it's registered with the relevant state or national business registry, check how long its domain has been registered, identify who actually owns and controls it, search court records for litigation and judgments, and look for a consistent reputation across sources the company doesn't control. A legitimate business withstands all of these; a facade usually fails several.

How can I find out who owns a company?

Start with the business registration filing, which often lists officers or a registered agent. Cross-reference domain registration records, professional networks, and press coverage. Be alert for nominee directors or shell structures where the public-facing names are clean but the real decision-makers are hidden behind layered ownership — a common tactic for obscuring a problematic history.

What are the red flags that a company is not legitimate?

Major red flags include: a domain registered only weeks or months ago despite claims of a long track record, no verifiable corporate registration, an address that is a mailbox or shared virtual office presented as headquarters, guaranteed or unusually high returns, pressure to commit quickly, unverifiable references, and executives whose claimed history can't be independently confirmed.

Does a registered company mean it is safe to invest in?

No. Registration confirms the entity legally exists, not that it is solvent, honest, or operating as described. Fraudulent operators register companies routinely. Registration is a baseline check, not a clearance — you still need to verify ownership, history, litigation, and reputation before committing money.

When should I hire an investigator to verify a company?

When meaningful capital is at stake, when ownership appears to run through shell entities or multiple jurisdictions, or when the people behind the company can't be independently verified, a professional investigation is worth it. Investigators surface litigation, dissolved entities, hidden ownership, and reputational history that scattered public sources make hard to assemble on your own.

How to Tell If a Company Is Legitimate Before You Invest

To verify a company is legitimate before you invest, check it through sources the company doesn't control: confirm it's registered with the appropriate business registry, check how long its domain has been registered (a recent domain undercuts claims of a long track record), identify who actually owns and controls it, search court records for litigation and judgments, and confirm a consistent reputation across independent sources. A real, operating business passes all of these. Registration alone is not clearance — fraudulent operators register companies too — so treat these as a sequence, not a single box to tick.

Anyone can build a company that looks real in an afternoon — a polished site, a logo, stock photos of a “team,” and a deck full of impressive numbers. None of that is evidence. Before you invest, buy in, or sign, the question isn’t whether the company presents well. It’s whether it withstands independent verification. Here is the sequence that answers that.

Start with corporate registration

Confirm the company legally exists where it claims to. Look it up in the relevant state or national business registry (for U.S. companies, the Secretary of State’s office in the state of incorporation). Check that:

The entity is actually registered and in good standing, not dissolved or delinquent
The registration date is consistent with the history the company claims
The name matches exactly what appears on contracts and marketing

Registration is necessary but not sufficient. It proves the shell exists — not that the business is solvent, honest, or operating as described. Fraudulent operators register entities as a matter of routine. Treat this as the floor, not the finish line.

Check the domain’s age and history

A company’s domain leaves a timestamp that’s hard to fake. Look up its registration date using a WHOIS or domain-history lookup. The single most revealing mismatch in business fraud is a company that claims years of operation running on a domain registered a few months ago.

Also note whether the domain’s registration details are hidden behind privacy protection (common and not damning on its own), and whether the company’s email uses its own domain or a free consumer address — a firm asking for serious money from a Gmail account warrants extra scrutiny.

Identify who actually controls it

The names on the website aren’t always the people in charge. Work out who genuinely owns and directs the company:

Pull the registration filing for listed officers and the registered agent
Cross-reference domain records, professional networks, and press coverage
Watch for nominee directors and layered ownership — clean public-facing personnel fronting for principals whose history is deliberately hidden

Opaque ownership structured across multiple entities or jurisdictions is one of the clearest signals that someone is working to keep their past out of view.

Search for litigation and judgments

Court records reveal how a company and its principals actually behave. Search for:

Civil litigation, especially fraud, breach of contract, and investor disputes
Judgments, liens, and bankruptcies against the company or its owners
Regulatory actions or sanctions from relevant authorities
A pattern of prior entities that formed and dissolved, particularly under the same people

A single lawsuit isn’t disqualifying — business involves disputes. A pattern, or anything involving fraud or investor harm, demands serious pause.

Verify reputation through sources the company doesn’t control

Testimonials on a company’s own site are marketing. Look for reputation in places the company can’t edit:

Independent reviews, industry coverage, and press that predates your contact
References you contact yourself — and confirm are real people, not coached confederates
Consistency between what the company says about itself and what independent sources show

Be aware that adverse press and complaints can be actively suppressed. Silence isn’t the same as a clean record; sometimes it means the record has been managed.

The red flags that should stop you

Any one of these warrants caution. Several together warrant walking away:

A domain registered recently despite claims of a long track record
No verifiable registration, or an entity that’s dissolved or delinquent
A virtual office or mailbox presented as a real headquarters
Guaranteed or implausibly high returns with little downside described
Pressure to commit quickly and skip verification
Unverifiable people — executives or references whose history can’t be confirmed
Ownership hidden behind shells or shifting entity names

When to bring in a professional

The public records that answer these questions are real, but they’re scattered across registries, court systems, domain databases, and jurisdictions — and the operators most worth investigating are the ones who’ve worked hardest to stay hard to find. When meaningful capital is at stake, when ownership runs through shell entities, or when the people behind the company simply can’t be verified, professional investigation pays for itself by assembling the full picture a casual search can’t.

This is the entity-level companion to vetting the individuals you’d partner with; for that side, see our guide on business partner due diligence. If the opportunity reached you through an online relationship, also read how the same tactics drive crypto investment romance fraud. In every case the principle is the same: verify before the money moves, because afterward is too late.