How to check whether a small online business is real before you buy

A real small business and a fake one can look identical on the page: the same template, the same stock photos, the same padlock, the same “trusted by thousands”. The difference lives in records the business does not control. Here is what to check, in the order a careful buyer would, and what each check does and does not prove.

1. Is the business on its state’s register?

Every US state keeps a public register of the companies formed or registered there; Florida’s is Sunbiz, and the others are a search away under “[state] business entity search”. Take the legal name from the site’s terms, its receipt or its footer — the name with LLC or Inc. on it, not the shop name — and look it up.

What you are looking for: an entry, its status (active or not), the date it was filed, and the city and state on the record. What it proves: the company exists. What it does not prove: that this website belongs to it. A scam site can borrow a real company’s name. So do the second half: does the city and state on the state record match the address the website gives for itself?

One fairness note. Many honest sellers trade under their own name with no company at all, so no entry is a question to ask, not a verdict.

2. When was the domain registered?

ICANN’s registration data lookup at lookup.icann.org shows, for any domain, when it was registered, when it expires and through which registrar. A shop that says “serving customers since 2015” on a domain registered six weeks ago has something to explain. Owner details are usually withheld for privacy; that by itself proves nothing either way.

3. Is the connection secure — and why that proves less than you think

Look for https and the padlock before you type a card number; without them, stop. But the padlock is a floor, not a verdict. In the FTC’s words: “The ‘s’ after http means the site is encrypted — but it doesn’t mean it’s a legitimate site. Scammers know how to encrypt sites, too.”

4. Are the policies posted, and do they fit the business?

Terms, a refund or return policy, and a privacy policy. The FTC: “The site must say whether you’re able to return the item for a full refund.” Read who pays return shipping, how many days you have and whether there is a restocking fee. A policy that does not fit the business — a clothing shop whose returns page talks about software downloads — was pasted from somewhere else, and that tells you how much care went into the rest.

5. Is the site on a browser blocklist?

Google’s Safe Browsing site status at transparencyreport.google.com tells you whether a site is currently flagged as dangerous. A listing is a stop sign. “No unsafe content found” means only that nothing has been reported; it is not a clean bill of health.

6. Who takes the payment?

A checkout that runs through a recognised payment processor and takes a credit card gives you a way back if something goes wrong; the FTC says paying by credit card “best protects you and your money in case of a scam”, and that you can dispute a charge for goods you never received. Its warning is just as plain: “Never buy anything from online sellers that insist you can only pay with gift cards, by wire transfers … with a payment app, or with cryptocurrency.” A seller who steers you off the checkout to pay a person directly has told you what you need to know.

What reviews and ratings tell you — and what they don’t

Reviews are about service: did the order arrive, was it as described, did a refund come through. Read several, from more than one place, and read them with the FTC’s caution in mind: “don’t rely on star ratings alone because some reviews and ratings are fake or misleading.” Automated rating sites are a different thing again. They score a website on signals they can measure from outside — how old the domain is, whether the owner is named — so a new, honest business scores badly on age alone. None of that checks the register. Use reviews for what they are, and go to the records for whether the business exists.

If the seller is on Instagram, Meta gives you one more check: open the profile, tap the three dots, then About This Account. Meta says it shows “when the account was created, the country where the account is based and any former usernames”.

Put it together

No single line decides it. A business that passes all of them has given you every public reason to trust it; one that fails the first or steers you off the checkout has given you every reason not to.

If the business has a Business Trust Record

Some businesses have had these checks done for them. A Business Trust Record is a public page, issued by ReclaimShield at the business’s request, that shows its state registration, whether the city and state on that record match its website, that the business controls its own domain, a secure site, posted terms, refund and privacy policies, and whether browser safety lists flag the site — each line read from its source, linked and dated, on a page the business cannot edit, and re-checked through the year. Anyone can look a business up at reclaimshield.io/lookup. If there is no Record for a domain, the lookup says only that, and the checks above still work.