Why a Website and a Handshake Aren't Enough

The website looked real. The handshake felt genuine. And still, the invoice went to a ghost.

Most of us vet business partners the same way: we check their website, skim their social media, maybe verify a phone number. It feels like due diligence. It isn't. According to BBB research, 73% of business impersonation scams involved fake or unverifiable contact details — meaning the scammers aren't hiding their information, they're manufacturing it. A polished website and a working phone line are exactly what a fraud operation builds first.

The scale of the problem is hard to overstate. Industry data shows that 40% of companies report being fraud victims, alongside 52% of end users. And the tactics are accelerating: Sumsub reports a 180% year-on-year growth in sophisticated fraud, driven partly by AI tools that make fake logos, cloned voices, and convincing fake documents cheap to produce. The impersonator you're evaluating today may look more professional than the legitimate vendor you've worked with for a decade.

This is why informal checks fall short. As verification experts note, reviewing web presence, social media, and contact details is a useful starting point, but these methods "are rarely totally sufficient to verify a business — especially in the eyes of regulatory agencies." A real business needs to be validated against official records, not against its own marketing.

The red flags that informal checks routinely miss include:

• Fake or missing registration numbers and tax IDs
• A missing or vague physical address, a common shell company signal
• No verifiable license listings in regulated industries
• Ultimate Beneficial Owners who can't be identified as real people
• Scammers unlawfully borrowing the details of legitimate businesses

Gut-feel vetting has become a genuine liability. Research on business verification fraud found that 94% of banking and FinTech institutions have encountered it firsthand — and the problem has spread well beyond finance into marketplaces, SaaS, and any company onboarding vendors or partners.

At My AI Call Center, we take list discipline seriously for the same reason: before any campaign launches, we review list sources and consent records, and we decline bought lists without clear permission records. Verification can't be a formality — it has to be a structured check against real, documented facts. The rest of this guide shows you how to do exactly that.

The Two-Part Verification Framework: Entity and Ownership

A polished website and a friendly voice on the phone tell you almost nothing. According to industry research, 73% of business impersonation scams involved fake or unverifiable contact details — meaning scammers are often very good at looking legitimate. That is why serious partner verification follows a structured, two-part framework known as Know Your Business (KYB).

Part one: validate the entity itself. This means confirming the business exists in official records under its legal name, with a registered address, current registration documents, required industry licensing, and valid tax identification. Experts define KYB as validating that a business exists and is being represented truthfully before you onboard it as a client or partner.

Part two: identify the Ultimate Beneficial Owners. A UBO is a natural person who owns at least 25% of stock investment and/or 25% of voting shares, per the standard UBO threshold. Verifying the entity without confirming the real people behind it leaves the door open to shell companies and hidden bad actors.

Why do both checks matter? Because a business can be real while the people running it are not who they claim to be. Common red flags include:

• Fake or missing registration numbers (EIN)
• Fake or missing physical address, which may signal a shell company
• Difficulty identifying Ultimate Beneficial Owners
• No verifiable license listing in regulated industries

Official government registries beat informal signals every time. Website reviews, social media checks, and contact validation are useful starting points, but they are "rarely totally sufficient to verify a business — especially in the eyes of regulatory agencies," as verification specialists note. The stakes are high: one industry study found 94% of banking and FinTech institutions have encountered business verification fraud.

Jurisdictional coverage is usually the first filter when verifying, since it determines what can be checked and where. That matters doubly for cross-border partners. A company like My AI Call Center, operating from Halifax, Nova Scotia with a U.S. base in Austin, Texas, illustrates why: a partner on either side of the border must be verified against the correct national and state or provincial registries, not just one country's records.

The same discipline applies to how My AI Call Center handles campaign lists — reviewing list sources and consent records before any campaign launches, and declining bought lists without clear permission records. Verification, whether of partners or contact lists, is about checking the source, not trusting the surface.

Red Flags That Should Stop Any Deal

Red flags that should stop any deal

Before moving forward with any business partner, certain warning signs demand immediate attention. Research shows that 73% of business impersonation scams involved fake or unverifiable contact details, making address and registration checks critical first steps. A missing or suspicious physical address often indicates a shell company designed to disappear after collecting payments or sensitive information.

Registration numbers provide another vital verification point, though EINs cannot be checked via public database according to industry sources. This limitation means legitimate verification requires specialized services that aggregate data from authoritative sources rather than relying on simple online searches. Fake or missing registration numbers consistently appear as red flags across multiple verification frameworks, particularly when combined with other warning signs.

Other critical indicators include missing privacy policies, difficulty identifying Ultimate Beneficial Owners who must own at least 25% of stock or voting shares, and no license verification listings in regulated industries. Scammers frequently unlawfully borrow details of legitimate businesses to create convincing facades, making thorough verification essential before sharing data or initiating campaigns. For My AI Call Center, these checks align with our commitment to only engage with approved, permissioned partners whose legitimacy we can confirm through structured due diligence.

How We Verify Before Any Campaign Launches

Verification is easy to talk about and harder to actually do — so here is exactly how we put the framework into practice at My AI Call Center before a single call goes out. The research is clear on why this matters: 73% of business impersonation scams involved fake or unverifiable contact details, which means a list that looks fine on the surface can still be a liability.

Every campaign begins with a list and consent review. We check three things before anything launches: where the list came from, what consent records exist for each contact, and whether the proposed calling windows fit the rules that apply in that jurisdiction. This mirrors the standard two-part verification approach experts recommend — validating the business itself and confirming the people behind it — because informal checks alone are rarely sufficient to confirm a list is legitimate and properly permissioned.

The most common red flag we see is the bought list. A vendor hands over thousands of contacts with no documentation of how those people agreed to be called. We flag those lists and, in most cases, decline them outright. It is a hard conversation to have, but we would rather tell you plainly that the list will not support the campaign before you spend anything than discover the problem after calls start.

Our pre-launch review covers:

• List source — where the contacts came from and how they were collected
• Consent records — documented permission for each contact, not assumptions
• Calling windows — approved hours and days that fit state-specific rules
• Script and escalation approval — nothing launches until you approve it

Verification does not stop at launch, and that is deliberate. The research consistently shows that business risk profiles change over a relationship's lifecycle, so a one-time check at onboarding is not enough. We treat verification as ongoing: opt-outs are logged and honored immediately, disposition codes are monitored in real time, and DNC requests carry across all campaigns and into your records.

This risk-based approach also matches what experts recommend — adjusting verification strictness based on risk exposure rather than applying a single shallow check to everything. Regulated industries like healthcare get extra scrutiny, and "not sure" answers in our intake process trigger a manual review rather than a shrug. Given that 94% of banking and FinTech institutions have encountered business verification fraud, assuming good faith is not a compliance strategy. The discipline is the product: approved, permissioned, reviewed lists only, verified before you spend a cent.

Your Action Plan: Run Verification Before You Sign

Your Action Plan: Run Verification Before You Sign

Verifying a legitimate business partner starts with concrete steps you can take before any agreement is signed. Begin by confirming the company's registration with official government registries in its operating jurisdictions, as this establishes legal existence and standing. Next, validate the physical address and tax identification number—whether EIN in the U.S. or BN in Canada—through authoritative sources, since 73% of business impersonation scams involve fake or unverifiable contact details, making this a critical red flag to catch early. Identify who actually owns the company by checking for Ultimate Beneficial Owners (UBOs), defined as natural persons owning at least 25% of stock or voting shares, to ensure transparency and avoid shell entities.

• Confirm registration with official registries (e.g., Corporations Canada, Texas Secretary of State)
• Validate physical address and tax ID using government or unified verification platforms
• Identify Ultimate Beneficial Owners (≥25% ownership/voting shares)
• Check industry-specific licensing where required (e.g., healthcare, finance)
• Require plain answers about data handling and consent practices upfront

For partners in regulated industries like healthcare or finance, verify that licensing is current and valid—scammers often misuse legitimate business details, so checking for proper license verification is essential. Throughout this process, insist on clear, upfront explanations about how data is handled, consent is obtained, and opt-outs are managed; legitimate providers will disclose these practices without hesitation. As emphasized by My AI Call Center’s approach, a trustworthy partner will always quote all costs before launch and report only what actually occurred—no inflated metrics, invented testimonials, or misleading numbers. This commitment to transparency ensures accountability and builds trust from the very first interaction. A recent study found that 94% of banking and FinTech institutions have encountered business verification fraud, underscoring why these steps aren’t just cautious—they’re necessary. By following this action plan, you protect your organization from risk while setting the foundation for a reliable, compliant partnership.