How to Verify a Business Is Real (and Spot a Clone) Before You Pay
A scam site looks exactly like the real one — except for the one detail that routes your money. Here is how to find it.
The modern local-business scam does not invent a company — it copies a real one. Same name, same address, same photos, sometimes the same stolen reviews. The only thing changed is the phone number or the checkout, which routes your call and your money to someone else. It works because everything looks right. Here is how to check the parts that scammers cannot fake for free.
1. Match the phone number to the record
Find the business's number on three independent sources — its Google Business Profile, its Secretary of State filing, and an old invoice or a licensing record — and confirm they match. A copycat usually shares the real name and address but shows a different, often VoIP, number. A mismatch is the tell.
The name and address are bait. The phone number and checkout are the hook. Verify those, not the branding.
2. Check when the website was registered
Run the domain through ICANN WHOIS. A real established business usually has a domain several years old. A clone site is often registered weeks ago, with privacy-shielded ownership and offshore hosting. A brand-new domain impersonating an established local name is a red flag by itself.
3. Confirm the entity and license
Look the business up in the state business registry and, for trades, the licensing board. Confirm the legal name, that it is active, and that the license number on the site actually belongs to that name — cloners paste a real license number they do not hold.
4. Read the reviews for reuse
Scam sites lift reviews. Copy a distinctive review sentence into a search engine; if it appears on other unrelated business pages, the reviews are stolen. Check whether the Google Business Profile's number matches the site — hijacked profiles swap the number while keeping the real reviews.
If you find a clone
Document it — screenshots with dates, WHOIS record, the swapped number — and report it to the FTC, the platform hosting the profile, and, if your name is being used, your own attorney. NU has covered exactly this pattern in the garage-door copycat record: a real business cloned, its reviews hijacked, its calls rerouted.
The takeaway
Four checks — phone across three sources, WHOIS age, registry + license, reused reviews — catch nearly every clone before you pay. Trust the record, not the polish.