The riskiest moment in any business relationship is not the contract or the handshake. It is the payment. An invoice arrives, the amount looks right, the details look familiar, and a bank transfer goes out — and if anything about that company or that invoice was not what it seemed, the money is usually gone the instant it lands. Fraudsters understand this perfectly. They do not waste effort on the early conversations. They wait for the moment a payment is about to be made, because that is the moment a small deception turns into real money.

Checking that a company is legitimate before paying it therefore means two things, not one. It means confirming the company is genuinely real and accountable — and it means confirming that this particular invoice, with these particular payment details, is actually coming from that company and going where it should. The second half is where most losses happen, and where most checks fall short.

What “legitimate” really means at the point of payment

It is tempting to treat legitimacy as a single yes-or-no fact about a business. In practice, a payment can go wrong in two distinct ways: the company itself can be fake, or a real company’s identity can be hijacked to redirect a genuine payment. A complete check has to guard against both.

To check if a company is legitimate before paying, the first task is to confirm the business is real, registered, and active. In the UK, that means looking it up on the Companies House register: confirming it exists under the name on the invoice, that it is currently active rather than dissolved or dormant, and that its registered details are consistent with the business you believe you are dealing with. This catches the crudest frauds — the invented company, the dissolved shell still issuing invoices, the trading name with nothing registered behind it.

But a real, legitimate company on the register is not, by itself, proof that the invoice in front of you is genuine. That is the gap fraud lives in.

Invoice and mandate fraud: the changed bank details

The most common and costly fraud at the payment stage is deceptively simple. A business receives an email, apparently from a known supplier, saying the company has changed its bank account and asking for future payments to go to new details. The email looks right. The branding is correct. The tone is familiar. And the new account belongs to a criminal.

This is known as mandate fraud or invoice fraud, and it succeeds precisely because the underlying company is legitimate — it is the payment details that have been tampered with. The defence is a habit, not a database: any change to a supplier’s bank details should be verified directly with that supplier, using a phone number or contact already known to you, never the contact details supplied in the suspicious email itself. A genuine supplier will not mind the call. A fraudster is counting on you not making it.

Clone firms: a real company’s identity, stolen

A second, more sophisticated fraud involves impersonating a legitimate, often well-regarded company outright. Criminals set up communications, and sometimes whole websites, using the real name, registration number, and address of a genuine business — then issue invoices or solicit payments under that borrowed identity. The victim checks the company, finds a real and reputable entity, and pays with confidence, never realising they were never dealing with that entity at all.

These “clone” frauds are well documented, and financial regulators repeatedly warn about cloned firms in particular. The protection is to confirm not just that a legitimate company exists, but that the people contacting you genuinely belong to it. Reaching the company through its own independently verified contact details — rather than the ones provided in the approach — is what separates the real business from the clone trading on its good name.

The mismatches that give fraud away

Much fraud reveals itself in small inconsistencies, each easy to explain away alone but telling when they appear together.

The name on the invoice should match the registered company name, or lead clearly to it. The bank account name should match the company being paid; a payment to an account in an unrelated individual’s or company’s name deserves a hard pause. A brand-new company with no trading history, issuing a substantial invoice, warrants more scrutiny than an established one. And the registered office, the contact details, and the company’s claimed size and history should hang together rather than quietly contradicting one another. Fraud rarely announces itself. It surfaces as a set of details that almost line up.

The pressure that should slow you down

One behavioural signal is worth more than any document: urgency. Fraud thrives on haste, because a rushed payment is one made before anyone stops to verify. An unexpected demand to pay quickly, a sudden change of details framed as time-critical, a threat that something will go wrong unless payment is made immediately — these are the conditions fraud needs, and the appropriate response to all of them is to slow down rather than speed up. A legitimate company can almost always accommodate a short delay for verification. The pressure to skip that step is itself the warning.

A simple sequence before you pay

Reduced to its essentials, checking a company’s legitimacy before paying an invoice is a short, repeatable routine. Confirm the company is real and active on the Companies House register. Confirm the invoice name and registered name align. Confirm the bank account belongs to the company being paid. Verify any change of payment details directly, through a contact you already trust. And treat urgency as a reason to check more carefully, not less. None of it takes long, and all of it sits between a business and the kind of loss that is almost impossible to recover once the transfer has cleared.

This grounded, practical caution is one the people who work with the register every day understand well. Your Company Formations, one of the UK’s established company formation providers, sits close enough to Companies House to know what its records can confirm about a company’s legitimacy — and, just as importantly, what they cannot, since a real company’s identity can still be misused at the point of payment. Having registered and maintained a large number of UK companies, it has seen how a clean, verifiable public record underpins trust, and why confirming both the company and the payment is the difference between a check that reassures and one that actually protects.

Verify the company, then verify the payment

The reason invoice fraud works is that it exploits the gap between two questions people tend to merge into one. Is this a real company? And is this real payment going to that real company? A business that checks only the first can still pay a fraudster. A business that checks both rarely does.

The register is public, the checks are quick, and the verifying phone call costs nothing but a moment. Most of the time, that moment simply confirms what was already true and the payment goes out as planned. Occasionally, it catches the one invoice that was never going to reach the company whose name was on it — which is precisely the payment worth pausing to check.