Small businesses routinely give vendors access to payment information, customer data, business email systems, cloud applications, accounting platforms, and internal files. The Federal Trade Commission (FTC) states that business vendors may have access to sensitive information about a company or its customers and recommends verifying that vendors comply with required security controls.
A 10-minute vendor check can establish several verifiable facts before an invoice is paid, an account is created, or business data is shared.
Minute 1–2: Check the Vendor’s Domain
The first check concerns the domain used for the vendor’s website and email.
A whois lookup can provide registration information associated with a domain. Domain registration records can contain details such as the registrar, registration dates, expiration dates, and domain status. Some registrant information may be hidden by privacy or proxy services. ICANN states that registration-data services are used for purposes including investigating online businesses, identifying technical contacts, and establishing online identities.
Record:
- Domain creation date.
- Registrar name.
- Domain expiration date.
- Domain status.
- Available registrant or organization information.
A recently registered domain does not establish that a vendor is fraudulent. It does establish that the domain has a short registration history, which can be compared with claims about how long the business has operated.
For example, a company claiming 15 years of operation while communicating exclusively through a domain registered several weeks earlier presents a factual discrepancy that requires additional verification.
Minute 3: Match the Email Domain
The sender’s email domain should be compared character by character with the vendor’s official website domain.
The FTC identifies spoofed or fabricated email addresses as a technique used in phishing and business-impersonation attacks. It recommends examining the sender’s actual email address rather than relying only on the displayed sender name.
Check for:
- Added or missing letters.
- Replaced characters.
- Extra hyphens.
- Different domain extensions.
- Subdomains designed to resemble the legitimate domain.
- Free email accounts used instead of the company’s published business domain.
An email from [email protected] is not the same domain as [email protected], regardless of the displayed sender name.
Minute 4: Verify the Company Independently
Company information in an email, invoice, proposal, or payment request should not be treated as independent verification.
Search separately for:
- The legal business name.
- The official website.
- The published telephone number.
- The physical business address.
- Relevant corporate or business-registration records.
- Professional licenses when the service requires licensing.
The FTC advises businesses receiving unfamiliar invoices to search independently for the company name together with terms such as “review,” “scam,” or “complaint.”
Contact information obtained independently is particularly important when verifying financial requests.
Minute 5: Check the Invoice Against Existing Records
Fake invoices remain a documented small-business fraud method. In May 2026, the FTC warned that scammers send invoices for products or services businesses never ordered, including invoices made to resemble communications from established companies.
Compare the invoice with:
- The approved purchase order.
- The signed contract.
- Previous invoices.
- The established billing address.
- The normal payment method.
- Previously verified bank-account details.
An invoice without a corresponding purchase, contract, or authorized order should not be approved solely because it contains familiar branding.
Minute 6: Treat Bank-Detail Changes as a Separate Verification Event
A request to change payment instructions changes the destination of company funds.
The new banking information should therefore be verified through a communication channel already known to belong to the vendor. The telephone number or contact information contained in the change request should not be the only verification source.
The FTC specifically recommends calling a vendor, colleague, or client through a telephone number already known to be correct when the authenticity of a request is uncertain.
Minute 7: Inspect Links Before Opening Them
The visible text of a hyperlink can differ from its actual destination.
The FTC recommends hovering over links before clicking and accessing account portals through the company’s known website rather than through links supplied in unexpected emails or text messages.
Current phishing attempts can also use polished writing, copied branding, fabricated login pages, and AI-generated content. Practical phishing protection in the AI era therefore requires checking technical details such as domains, URLs, sender addresses, and authentication requests rather than evaluating a message only by its appearance.
Minute 8: Check What Data the Vendor Will Receive
Vendor risk depends partly on the information and systems available to the vendor.
Document whether the vendor receives:
- Customer personal information.
- Employee records.
- Payment information.
- Login credentials.
- Cloud-platform access.
- Internal documents.
- API access.
- Administrative privileges.
The FTC recommends specifying in vendor contracts how data can be used, shared, retained, and deleted and establishing processes to verify vendor compliance.
Minute 9: Check Account Security Requirements
If a vendor receives access to company systems, authentication controls become directly relevant.
CISA recommends multifactor authentication for business systems, including email, file storage, remote access, administrative accounts, and accounts handling sensitive information. CISA identifies phishing-resistant MFA methods as stronger protection than passwords alone.
Confirm whether vendor accounts support or require:
- Multifactor authentication.
- Individual user accounts.
- Restricted permissions.
- Removal of unnecessary accounts.
- Administrative-access controls.
Shared credentials reduce the ability to attribute account activity to a specific user.
Minute 10: Record the Result
The final minute should create a verification record.
Store:
- Vendor legal name.
- Verified website and domain.
- Verified contact details.
- Date of the check.
- Name of the person performing the check.
- Approved payment details.
- Systems or data accessible to the vendor.
- Identified discrepancies.
- Required follow-up actions.
A documented record also creates a baseline for later changes. A new email domain, telephone number, bank account, payment method, or login portal can then be compared with previously verified information.
The 10-minute check does not establish that a vendor is permanently trustworthy. It establishes specific facts about the vendor’s identity, domain, payment instructions, data access, and security controls before the business relies on them.