You found a supplier online, exchanged a few professional-looking emails, and now they’re asking you to wire $18,000 for the first order. The website looks clean, the prices are competitive, and they sent you a PDF invoice with a real-looking logo. This is exactly the moment most businesses get burned. Business email compromise and fake supplier scams cost U.S. companies over $2.9 billion in a single year, according to the FBI’s Internet Crime Complaint Center — and the overwhelming majority of those losses came through wire transfers that couldn’t be reversed.
The good news: a supplier that actually exists leaves a paper trail you can find in under an hour if you know where to look. Here’s how to do it systematically.
Step 1: Start With the Business Registration Record
Every legitimate company operating in the United States is registered with a state authority — a Secretary of State office, a Department of State, or an equivalent agency. This is your first and most important checkpoint. A real supplier will appear in that database. A fake one usually won’t.
How to find the registration
Ask the supplier for their full legal business name, their state of incorporation, and their EIN (Employer Identification Number). Then go directly to that state’s official business search portal. Most states have a free public lookup — California’s is at bizfileonline.sos.ca.gov, and every other state has an equivalent. The usa.gov/business portal lists links to each state’s business registry.
What you’re confirming: the company name matches exactly, the registration is active (not dissolved or revoked), the registered agent address is a real physical location, and the incorporation date makes sense for an established supplier. A company incorporated three weeks ago that claims to have been in business for a decade is a red flag you cannot ignore.
Cross-check the EIN
You can’t look up an EIN directly through the IRS as a third party, but you can ask the supplier to provide a W-9 form. A legitimate business will send this without hesitation — they need it for their own tax records anyway. The name and address on the W-9 should match the state registration exactly. If they balk at sending a W-9 before an order, stop there.
Step 2: Verify the Physical Address Is Real and Operational
Scammers can rent a virtual mailbox for $10 a month and list it as a business address. Your job is to determine whether the address on file is a warehouse, an office, or a mail forwarding service with 400 other “businesses” at the same suite number.
Pull up the address on Google Street View and look at it. A supplier of industrial components should not be operating out of a UPS Store in a strip mall. Search the address on Google Maps and check what other businesses share the building — if you see dozens of different company names at the same suite, you’re looking at a virtual office service.
Then call the main phone number listed on their website — not the number in the email they sent you, and not the number on the invoice. Go to their website, find the contact page, and dial that number. Ask to speak with your contact by name. A real company with real employees will handle this call normally. A scam operation will often have a single person answering who stumbles when you ask for someone specific or claims everyone is “in a meeting.”
Step 3: Run a Layered Online Verification
No single search will tell you everything, but four or five independent searches together build a picture that’s hard to fake.
Check the domain age
Go to a WHOIS lookup tool — there are several free ones, including the one at lookup.icann.org — and enter the supplier’s website domain. Look at the registration date. A company that claims 15 years of experience but registered their domain 14 months ago has some explaining to do. Also check whether the registrant information is hidden behind a privacy service: legitimate B2B suppliers rarely hide their domain ownership.
Search the company name in business directories
A supplier with real history will appear in multiple places: national business directories, local yellow pages, industry association member lists, and review platforms. Search the company name in a U.S. business directory and see what comes up — look at the listed address, phone number, and any reviews. If the company appears nowhere except its own website and the email you received, that absence is significant. Established businesses accumulate a digital footprint over time. New fake ones don’t have one yet.
Search for complaints and litigation
Type the company name followed by “complaint,” “scam,” “lawsuit,” and “fraud” into Google. Also check the Better Business Bureau at bbb.org. A single complaint isn’t necessarily disqualifying, but a pattern of complaints about non-delivery, billing disputes, or communication blackouts after payment is a serious warning. Check court records if the dollar amount is significant — many state court systems have free public search tools where you can look up civil cases by company name.
Step 4: Verify the Banking Details Independently
This step is specifically about wire fraud prevention, and it’s the one most businesses skip because it feels awkward. Don’t skip it.
Before wiring any money, call the supplier using the phone number you verified in Step 2 — not any number they give you in an email or invoice — and verbally confirm the wire transfer details. Read back the bank name, the account number, the routing number, and the beneficiary name. Ask them to confirm each one out loud.
Why does this matter? Because a common attack called Business Email Compromise (BEC) involves a scammer intercepting your email thread with a real supplier and sending you a spoofed invoice with different banking details. The supplier is real. The bank account is not. You confirm the wire details by phone, using a number you found independently, and you eliminate this entire category of fraud.
If the bank account is in a country different from where the supplier is registered — for example, a U.S.-registered company with a wire address in Hong Kong or Eastern Europe — ask for an explanation in writing before proceeding. This happens legitimately sometimes, but it requires a clear, documented reason.
Step 5: Request a Small Trial Order Before Committing to Large Transfers
This is simple and effective: propose a small pilot order before committing to a large payment. A legitimate supplier will understand the logic — many of them apply the same caution with new customers on credit terms. A supplier who refuses any trial order, insists the minimum purchase is $15,000, and won’t negotiate is applying pressure tactics that should make you uncomfortable.
If the nature of the product makes a trial order impractical, ask for references — specifically the names and contact information of two or three other U.S. businesses they currently supply. Contact those references directly, using contact information you find independently (not the numbers the supplier gives you), and ask straightforward questions: How long have you worked with them? Have payments and deliveries gone smoothly? Would you wire them money again?
Step 6: Use Your Business Directory as a Starting Point, Not an Endpoint
Online business directories and local listings are genuinely useful for finding suppliers and vendors — but they’re a starting point for your search, not a final stamp of approval. A listing in a directory tells you the company has a presence; it doesn’t tell you the wire details in their latest invoice are legitimate or that the company hasn’t been taken over by a fraudster who compromised the email account.
Think of a directory listing as a first-pass filter. It gives you a phone number to cross-check, an address to verify, and a name to search in state records. From there, your own verification process takes over. The businesses that get defrauded are almost always the ones who stopped at the directory listing and treated the presence of a profile as sufficient proof.
Common Mistakes to Avoid
The most dangerous mistake is using the contact information from an invoice or email to “verify” that same invoice — you’re asking the potential fraudster to confirm their own fraud. Always verify using independently sourced contact details. A close second is rushing because of a deadline: scammers routinely manufacture urgency (“the price locks in today,” “the shipment leaves Friday”) specifically to prevent you from taking the time to verify. A real supplier will give you 24 hours to confirm wire details; one who won’t is telling you something important. Finally, don’t assume that because you’ve worked with a supplier before, the new banking details in their latest invoice are legitimate — account takeover fraud targets existing business relationships precisely because that prior trust makes you less likely to question a change.
