How to Verify a Business Lead: 4 Checks for Small Firms
To verify a business lead, run four checks: does the email domain belong to the company and receive mail, how old is the website, what kind of phone line is it, and is the company in a business registry. No single check is proof, but a lead that fails several needs a phone call before you reply.
Why verify a lead at all
Most leads are exactly what they look like. The few that are not cost far more than the time it takes to check: a fake quote request that delivers malware, an overpayment scam that ends with you refunding money that never existed, or a “new customer” that is really after your invoices and contacts. A two-minute habit filters most of these out before you invest time in a proposal.
The four checks
1. Email domain. Look at the domain after the @. Does it match the company’s website? Does it actually receive mail? Is it a known throwaway inbox service? Does it imitate a well-known brand?
2. Website age. A domain’s registration date is public. A company that claims a long history should not have a website registered a few weeks ago.
3. Phone line type. The first six digits of a North American number show which carrier holds it and whether it is likely mobile, landline or VoIP. Check whether the line type fits the story, and whether other people have reported it.
4. Company registry. Search the company’s legal name in a business registry and compare the status, date and city with what the lead told you.
Does the email domain have to match the website?
For an established company, it should. Someone writing from sales@example.ca with a website at example.ca is consistent. Someone claiming to represent a large firm from an unrelated domain, or a domain one letter off the real one, is not. A mismatch is not proof of fraud, but it is the most common red flag in fake leads.
Is a mobile or VoIP number a red flag on a lead?
Not on its own. Many small businesses and sole proprietors run entirely on a mobile phone, and many offices use internet phone systems. It becomes a warning when it contradicts the lead, for example a “head office” reachable only on a VoIP line with no website, or a number that other people have already reported.
What Corporations Canada covers and does not
Corporations Canada, part of Innovation, Science and Economic Development Canada, keeps the registry of corporations created under federal law. Its database is the source to confirm a federal corporation exists, including its status and incorporation date. TrustOrNah’s lead check matches company names against 1,571,855 records from the Corporations Canada open data.
What it does not cover:
- Corporations created under provincial or territorial law, which register with their own province or territory.
- Corporations created under financial laws, such as banks, insurance companies and trust companies, or under foreign law.
- Sole proprietors and partnerships, which do not incorporate.
So a federal match with “Active” status is a strong positive signal, but no match means very little. Many real businesses are provincial corporations or sole proprietors. For those, the federal search page points to Canada’s Business Registries, which searches several provincial registries, or you can search the registry of the province the lead says it is in.
When a free Gmail address is fine
A plumber, a photographer, a bookkeeper working alone: plenty of real customers and partners use Gmail, Outlook.com or a similar free address. That is normal and should not count against them by itself. The lead check reflects this; a Gmail address with a mobile number usually gets Caution, which means “verify”, not “fraud”.
A free address matters when it does not fit. A buyer who says they work for a national retailer, a government department or a bank should be writing from that organization’s domain. If the free address comes with urgency, an unusual payment method or a request to open a file, call the number listed on the organization’s own website before replying.
TrustOrNah’s lead check runs all four checks at once and returns one verdict: Nah means at least one strong red flag, such as a domain imitating a bank or courier, a domain under 90 days old or a phone number with complaints. Caution means two or more weaker warnings. Trust means nothing stood out and at least one signal, such as a working company email domain or website, identifies the sender.
What to do now
- Run the four checks on any lead that asks you to click, open, pay or change bank details.
- Treat Caution as a reason to call the lead on a number you found yourself, not as a rejection.
- Never refund an overpayment until the original payment has fully cleared with your bank.