Before You Wire the Deposit: Verifying a New Supplier

A first order with a new supplier is the least protected money a small business ever moves. There is no chargeback on a bank transfer, no platform holding the funds, and usually no contract either, just an invoice with bank details and a promise about a ship date. The deposit is 30 percent, the supplier is 8,000 kilometres away, and the entire basis for sending it is that the website looked professional and the person on the video call seemed fine.

Both halves of that sentence got cheaper to fake in the last two years. The useful response is not more suspicion, it is knowing which checks actually resolve against something outside the supplier's control and which ones only confirm that the supplier can produce a file.

What can a supplier fake now that they could not fake in 2023?

Nearly the whole presentation layer. Photographs of a production line, a factory audit certificate, a video walkthrough, a staffed website in fluent English, a LinkedIn history for three employees, and a passport image for a director are all now producible at negligible cost.

This is not speculation about what might happen. The US Treasury's financial crimes unit issued an alert on fraud schemes involving deepfake media on 13 November 2024, and the specific typology it described was fraudulent identity documents used to bypass verification systems. Director Andrea Gacki's framing was that bad actors are seeking to exploit the technology to defraud American businesses. Banks were the audience because banks file the reports. The technique does not care who is looking at the document.

The consequence for a small buyer is narrow and important. Any check whose output is "they sent me the thing I asked for" has lost most of its value. A supplier who can generate a business licence can generate a quality certificate, and the two arrive in the same email.

How much money is actually moving through this?

Enough that it sits second in the FBI's own ranking. The 2025 IC3 annual report logged 1,008,597 complaints and 20.877 billion dollars in reported losses, a 26 percent rise on 2024, with an average loss of 20,699 dollars. Business email compromise, which is the category that covers a redirected supplier payment, accounted for 3,046,598,558 dollars.

Those two numbers together are the argument for reading the rest of this. An average loss of 20,699 dollars is not a corporate figure. It is roughly one container, or one season of stock, and it is the size of loss that ends a small business rather than annoying it.

Nobody publishes that ranking beside a commentary on what each line means for a business that buys stock, which is why it is worth assembling. The pattern it shows is that the largest category by loss is not a business risk at all, and the one that is sits directly on the payment you are about to make.

Which checks resolve against something outside the supplier's control?

Three, and they are the ones worth your time. Each one queries a register the supplier does not operate, so the answer arrives from somewhere else or it does not arrive.

The first is the company itself in its own national register. Not a screenshot of a registration, the register. What you are reading is the status field rather than the existence of an entry, because a dissolved company and an active one both have entries. In the UK this check is becoming materially stronger: Companies House made identity verification mandatory from 18 November 2025, with a 12 month transition and an estimated 6 to 7 million individuals required to verify by mid November 2026. More than 300,000 had verified voluntarily before the rollout. From the end of the transition, a UK director's identity has been checked by someone other than the director.

The second is an identifier that resolves. A Legal Entity Identifier is a 20 character code that links to reference data from authoritative local sources, covering who is who and who owns whom. Not every small supplier has one, and the absence is not suspicious. The presence of one that does not resolve to the name on your invoice is decisive.

The third is the bank account holder name, and it is the single highest value check on this page. The account name must match the legal entity name on the invoice, not the trading name and not a similar name. A mismatch here is the mechanism in almost every redirected payment case, and it is visible before the money leaves.

Where does AI genuinely help in supplier verification?

In writing the questions and reading the answers, not in reaching the verdict. An assistant asked whether a company is legitimate will summarise the web, and the web about a small unknown supplier is mostly pages that supplier wrote.

That distinction has a practical shape. Three uses hold up well. Generating a document request list specific to your product category, because you do not know what a compliant test report for a children's toy contains and a model does. Reading a 40 page audit report and telling you which clauses are conditional or expired, which is careful reading at speed. Comparing this quotation against the last four you received and naming what changed, which is where quiet term changes hide. That third use is close to reading a supplier's terms before you sign them, and the same caution applies: the tool finds what is in the text, not what is missing from it.

Two uses fail badly. Asking a model to judge whether a company is real, because it has no privileged data and will produce a confident paragraph from the supplier's own marketing. And asking it to verify a document's authenticity from an image, because the generated document and the genuine one are both images of the thing they claim to be.

There is a third failure worth naming because it is new. A supplier may be running the same tooling on you. A fluent, responsive, technically knowledgeable counterparty who answers instantly at 3am is not necessarily a well run business. It may be a small operation with good tooling, which is fine, or a script, which is not. This is the same reasoning that applies to a voice on the phone that sounds exactly like the person you dealt with last month.

What should you ask for, and what does each answer prove?

Ask for evidence you named rather than the pack they send everyone. A supplier's standard document bundle is optimised for looking complete. A request for one specific thing, chosen by you, is a test of whether they can produce something they did not prepare in advance.

Good examples: a photograph of today's production floor with a piece of paper in frame showing a number you chose. An export declaration from a shipment in the last quarter, with the consignee redacted. The full contact details of two customers in your own country, not testimonials. A video call placed by you to a landline at the registered address rather than a call they set up.

None of those is conclusive on its own. All of them are harder to fake on demand than a certificate, because they are specific and time bound, and that is the property you are buying. Verification for a small buyer is not about establishing certainty. It is about raising the cost of the deception above the size of your deposit.

What does a register entry actually tell you?

Less than people assume, and the gap is worth stating precisely. A register confirms that an entity was incorporated, that it has filed what it was required to file, and that its status today is active or otherwise. It says nothing about whether the company can make your product.

That is the standing limitation of every entity check, and it explains why buyers who did their homework still get burned. Capacity, quality control, and whether the factory in the photographs belongs to this company rather than a neighbour are not register facts. A trading company that has never touched a machine can be perfectly registered, perfectly compliant, and perfectly willing to subcontract your order to whoever quotes lowest, which is the most common reason a second production run comes back different from the sample.

So read the register for what it is good at. Incorporation date tells you whether the business is older than its website. Filing history tells you whether anyone has been maintaining it. Registered address tells you whether the address on the invoice was invented. A change of directors three weeks ago on a company that has existed for ten years is worth a question. None of it substitutes for knowing who physically makes the goods.

Platform badges deserve the same scepticism, and a small amount of respect. A marketplace verification usually means a third party checked a business licence at some point, which is genuinely more than nothing and considerably less than an audit. The badge answers whether the entity exists. Your money is exposed to whether the entity performs, and those are unrelated questions. Anyone relying on a badge alone is in the position described in the questions worth asking before you buy any tool or service, where the vendor supplied both the claim and the evidence for it.

The control that works when every check passes

Split the payment. This is the part of the subject that gets the least attention and does the most work, because it is the only control that still functions against a supplier who passes every check and then simply does not ship.

A first order is an experiment, so price it as one. Make the first order small enough that losing all of it is survivable, and accept that the unit cost will be worse. Pay the deposit against a document that has independent existence, such as a bill of lading rather than a photo of a pallet. Where the amount justifies it, use a third party inspection before the balance payment, which costs a few hundred dollars and is the only step on this page that puts an unaligned party in the room. And pay from an account that is not your operating account, so a compromise of the payment route does not reach your working capital.

The staging also gives you something no check produces: a supplier's behaviour under a condition they did not choose. How a counterparty reacts to a request for a smaller first order tells you more about their business than any certificate. A real factory with capacity finds a small order mildly annoying. An operation with no factory finds it fatal, and the response tends to be pressure about the deposit.

Is an inspection worth a few hundred dollars?

On any order above roughly ten times the inspection fee, yes, and the reason is structural rather than technical. An inspection is the only step in this whole routine that puts a person with no stake in the transaction physically in the building.

What you get is narrow. An inspector confirms the goods exist in the stated quantity, samples them against a specification you wrote, and photographs the packing. What you do not get is an opinion on the company, a legal check, or any protection if the goods are fine and the shipment never leaves. The value is concentrated entirely in the timing: the report arrives before the balance payment, which is the last moment your money is still yours.

The specification is the part buyers get wrong. An inspector measures against what you wrote down, so vague instructions produce a report full of photographs and no findings. This is one of the better uses for an assistant: give it your product description and ask it to draft a measurable checklist, then cut everything you cannot define a pass or fail for. Carton drop height, stitch count, label placement tolerance, and moisture content are checkable. "Good quality finish" is not, and an inspector will not invent a standard you failed to supply.

Where the order is too small to justify the fee, the substitute is a sample from the actual production run rather than from stock, shipped by courier at your cost before the balance is released. It is weaker evidence than an inspection and considerably stronger than a photograph, because a physical object arriving from a real address is expensive to fake at scale.

Doing this in an afternoon

The whole routine fits in about two hours for a first order, and most of it is waiting. Look up the entity and read the status. Compare the legal name against the bank account holder name character by character. Search the identifier if one was given. Draft your document request with an assistant, then send it yourself with one item they could not have anticipated. Place your own call to a number you found rather than one you were given.

Then write down what you found, because the second order is where the value compounds. A short file per supplier, holding the register entry, the bank name you verified, the date you verified it, and the documents you received, turns every subsequent order into a comparison rather than a fresh investigation. It is also the record that makes a dispute arguable later. Keeping that file inside the systems you already run beats a folder on a laptop, and the storage and access questions there are the same ones covered in how a platform holds the data inside your project.

One last piece of arithmetic to keep the effort proportionate. If your first order is 800 dollars, spend an hour. If it is 8,000, spend a day and buy the inspection. If it is 30,000 with a supplier you have never met, the cost of a specialist due diligence report is a rounding error against the exposure, and declining to spend it is a decision about the 30,000 rather than about the report. The same logic that applies to running a credit check on a business customer before extending terms applies in reverse when you are the one paying first.

Supplier verification will not get easier from here. The generation tools improve on a faster cycle than the registers do, and the asymmetry favours whoever is producing the documents. What does not degrade is a check that queries a third party, and a payment schedule that limits what a single wrong judgement can cost. Build the routine around those two and the rest is housekeeping.