What B2B Website Owners Should Verify Before Onboarding New Business Clients Online

Most B2B sites onboard new clients through a form requesting a company name, work email, and occasionally a VAT number. Once submitted, an account is created, often granting portal access, pricing, and payment terms within a week. This process is intentionally designed to resemble a purchase rather than an application to maximize conversions.

The reality is that all information provided on the form is unverified. The company name is self-reported, and the email domain may only appear legitimate. There is no confirmation that the individual completing the form is authorized to represent their employer.

In 2025, the FBI’s Internet Crime Complaint Center reported $20.877 billion in losses from 1,008,597 complaints. Business email compromise accounted for $3.05 billion from 24,768 complaints, making it the second most costly category after investment fraud. BEC targets businesses by exploiting unverified email addresses and company names. The same vulnerabilities that allow payment redirection also enable fraudulent account creation.

A company name entered in a form is only a claim

Verifying a business client starts with a boring question: does this legal entity exist, right now, in the jurisdiction it says it’s in?

This is less straightforward than it appears. A trading name may differ from the registered name. A dissolved company can still maintain an active website, phone number, and sales presence. A registration number may reference a legitimate company unrelated to the applicant. Relying on search engine results can provide misleading information, and a false sense of diligence is more harmful than no verification.

A know your business solution handles this by querying the official corporate registry for the relevant jurisdiction. It retrieves the registered entity, current status, registered address, and, where available, its officers. This information is then compared to the applicant’s submission, allowing discrepancies to be identified objectively rather than relying on subjective judgment.
The key benefit is not just the lookup, but retaining the resulting record. If a dispute arises months later regarding the contracting party, you have the registry response as it existed at the time of onboarding.

The individual registering is not automatically authorized to sign

This is the verification step most often overlooked by B2B teams, and it does not have a B2C equivalent.

Possession of a company email address does not guarantee authorization to open an account, accept terms, or assume a credit line. Contractors, agencies, interns, and departing employees may have valid addresses at companies whose finance teams are unaware of your business. When invoiced, the company may assert that no authorized individual agreed to the terms, and this is often accurate.

Two measures help decrease this risk. First, verify the named signatory against officers or directors listed in the corporate filing, where available. If this is not possible, or if the signatory is a delegate, obtain documented authorization from someone listed in the official record. These steps are simple and can resolve potential invoice disputes.

For example, a wholesale platform onboarding a restaurant group under net-30 terms should confirm whether the applicant is a director, a purchasing manager with delegated authority, or an unrelated supplier representative.

The email domain provides more insight than the email address itself

While anyone can enter a company name, registering a supporting domain requires additional effort, making the domain a more reliable indicator.

Several factors have to be checked automatically: the domain’s registration date, whether it resolves to an established website rather than a parked page, if it closely resembles a larger company’s domain, and whether a corporate account is being opened with a free consumer email service.

None of these factors alone is definitive. Legitimate new businesses may have recently registered domains. However, considered together, these checks help distinguish genuine companies from fraudulent ones. For example, a domain registered eleven days ago that closely mimics a well-known brand and applies for terms in that brand’s name is a clear warning sign.

Screening once is not screening

Conducting sanctions and watchlist screening during onboarding is standard practice, but leaning solely on this creates a false sense of security. These lists and company statuses change frequently. A client who passed initial checks may become a risk months later, and onboarding checks alone will not reveal this.

The exposure here is not theoretical. OFAC assesses penalties per violation, and the ceiling under the International Emergency Economic Powers Act was adjusted to $377,700 per violation in January 2025, with an inflation adjustment applied each year. A US business does not need to have meant anything for a transaction with a sanctioned party to be a problem.

Ownership can also change without notice. A client company may be acquired, restructured, or transferred to new shareholders, leaving the former entity as a shell with a familiar name. These changes are not reflected in your CRM, as contact details, domains, and purchase orders may remain unchanged.

The practical solution is to conduct periodic re-screening and to re-verify company status and officers. Clients with lapsed registrations, changed directors, or those who have moved jurisdictions should be reviewed before processing further orders.

Assess your exposure before determining the level of verification required

B2B site owners may be concerned in relation to potential conversion loss. The appropriate approach is to align the level of verification with the associated risk, rather than applying a uniform standard.

A self-serve subscription billed monthly by card presents minimal risk and can be refunded if necessary. Net terms on large orders expose you to the full order amount and possible collections. Portals granting access to documents, pricing, or client data present risks which cannot be reversed.

Align the depth of verification with the account’s permissions rather than its creation date. Begin with minimal checks and controlled access, then perform comprehensive entity and authority verification when clients request terms or elevated access. This approach brings necessary friction only when it is justified and provides protection when it is most needed.

Where this belongs in your onboarding flow

Three key changes can considerably improve onboarding without demanding a complete redesign of your form.

• Request the registration number and jurisdiction in addition to the trading name. This single additional field eliminates most subsequent ambiguity.
• Implement automatic verification at the time of submission rather than relying on manual checks after access is granted. Post-access reviews serve as reports, not as effective controls.
• Direct verification failures to a review process rather than immediate rejection. Most mismatches result from typographical errors, recent name changes, or registry delays. Strict rejection policies may result in lost clients and encourage workarounds.

Retain all verification records, including the registry snapshot, screening results, domain age, and collected authorizations. Maintaining the records is cost-effective and essential for resolving disputes, responding to bank inquiries, or observing patterns across multiple accounts.

These measures are not about treating new clients with suspicion, but about having documented clarity regarding your business agreements. While most B2B sites can track user actions in detail, being able to identify the company that registered is even more valuable when issues arise.