Verify a prospective buyer in stages before disclosing confidential information: record the person’s full name, role, organization, and stated purpose; corroborate the organization through an appropriate public registry or filing source; confirm that the email domain and phone number are consistent with independently found company contact details; and ask for the legal entity that would receive the information. Then verify the contact through a separate channel and keep a dated record of what was checked. These checks do not establish financial capacity, acquisition authority, or willingness to close. If the identity, entity, authority, or requested disclosure level remains unclear, pause and ask qualified legal counsel how to proceed in your jurisdiction.
Define what you need to verify
Buyer verification is not one question. It has at least four parts: who is communicating, which organization they represent, which legal entity would receive your information, and whether the person is authorized to discuss the opportunity. A person can be genuine while the proposed recipient is an unrelated affiliate, a newly formed vehicle, or an adviser whose client has not been identified.
Write down the claimed name, title, organization, website, email domain, phone number, location, purpose of the request, and proposed recipient entity. Ask whether the person is a principal, employee, attorney, investment banker, lender, consultant, or intermediary. Keep this exercise separate from assessing financial capacity, acquisition criteria, or decision authority. Those are different diligence questions and require different evidence.
Start with the legal entity, not the message
Ask for the exact legal name of the organization that would receive confidential material, including any jurisdiction of formation and, where applicable, registration or company number. A trade name or website brand is not necessarily the contracting or acquiring entity. If the person says an acquisition vehicle will be formed later, record that as unresolved rather than treating the current correspondent’s company as the recipient.
Use an appropriate official registry, regulator database, or public filing system for the relevant jurisdiction to compare the legal name, status, registered address, officers or directors where available, and reported business purpose. For entities that file with the SEC, EDGAR can search electronic filings by company name, ticker, CIK, or individual name and offers filing categories and date filters [3]. A public record is a corroborating source, not proof that the person who contacted you controls the entity.
Corroborate the person and contact channel
Check whether the person’s name and stated role appear on an independently found company website, filing, professional directory, or other source appropriate to the claimed organization. Treat social profiles, copied logos, and a polished signature as clues rather than conclusive evidence. Compare the sender’s complete email address, not just the displayed name. Look for lookalike domains, substituted characters, unexpected forwarding addresses, and a mismatch between the claimed organization and the reply-to address.
CISA identifies lookalike sender addresses, spoofed links, urgency, and unsolicited requests as phishing indicators. It advises verifying an unknown person directly with the claimed company and not using contact information supplied by a suspicious request [1]. Apply that principle before sharing financial statements, customer lists, employee data, contracts, credentials, or other sensitive material. A phone call to a number copied from the original email is not an independent check.
Use a separate-channel confirmation
Find the company’s main number or another contact route independently, then ask the organization to confirm that the person works with it and is handling the stated inquiry. Do not ask the original correspondent to provide the only number you use for confirmation. If the organization has a known executive, adviser, or gatekeeper, confirm through a previously established channel or a trusted professional contact.
A second channel reduces the risk that one compromised mailbox or spoofed number controls the whole conversation, but it does not prove every statement is true. The FBI’s IC3 guidance for business email compromise recommends secondary channels or two-factor authentication for verifying sensitive account-change requests and checking the full sender address [4]. For a sale process, adapt the same control to a disclosure decision: one human reviewer should confirm the identity and record how the confirmation was obtained before access expands.
Match disclosure to the evidence
Use staged disclosure rather than treating verification as a single pass or fail. At the first stage, share only information that is already public or deliberately prepared for initial inquiries. After the entity and contact channel are reasonably corroborated, consider a limited overview under a confidentiality process reviewed for the transaction and jurisdiction. Reserve detailed financial, operational, employee, customer, security, and contractual information for a later stage with a clearly identified recipient and documented permissions.
A confidentiality agreement can define permitted use and handling, but it does not authenticate a person by itself. Check who signs, which legal entity is bound, whether affiliates or advisers are covered, how onward sharing is handled, and what happens if the recipient changes. The appropriate language and enforceability depend on the governing law and facts. A qualified attorney can help assess those issues; this article does not provide individual legal advice.
Keep an evidence and permission record
Create a short verification record for each prospective buyer. Include the date, source URLs or registry references, the claimed individual and entity, the independent contact used, the person who performed the check, unresolved inconsistencies, the approved disclosure stage, and the next review date. Store only the personal information needed for the process and restrict access to people who need it.
Record the source of truth for each field. For example, an official filing may support an entity name, while an independently confirmed company contact may support the person’s affiliation. Do not copy a weak source into a stronger category. If records conflict, preserve the conflict and stop the next disclosure step until a human reviewer resolves it or decides that the inquiry should end.
Set stopping conditions and human ownership
Pause disclosure when the correspondent refuses to identify the recipient entity, insists on an unusual communication channel, creates unexplained urgency, asks for information unrelated to the stated purpose, or cannot be independently confirmed. Also pause when the requested material includes personal data, regulated information, customer confidentiality obligations, export-controlled content, or security-sensitive details that require specialist review. A failed check is not proof of fraud, but it is a reason not to increase access.
If software or AI helps organize the workflow, assign a named human reviewer for identity matching, source checking, permission changes, and the final disclosure decision. Use the approved entity record and verification log as source-of-truth records. Test for duplicate names, lookalike domains, stale filings, inconsistent dates, and unsupported conclusions. Pilot the workflow on low-risk inquiries, stop the pilot if it creates false matches, loses the evidence trail, or suggests disclosure without an explicit human approval. Do not allow automation to contact buyers, negotiate, approve access, or disclose documents on its own.
Use a consistent owner-operated process
A repeatable checklist helps prevent enthusiasm about a possible buyer from outrunning basic verification. The owner or assigned adviser should decide the minimum evidence needed for each disclosure stage, document exceptions, and revisit the record when the proposed recipient, adviser, or communication channel changes. In a multi-jurisdiction process, ask local counsel whether privacy, confidentiality, securities, export, employment, or sector rules alter the review.
Acquivo gives business owners the entire sell-side process an investment bank would run, as software, with no success fee. It is user-operated software, so the owner or authorized professional remains responsible for reviewing evidence, setting permissions, and deciding what to share. Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.
Key Points
- Identify the person, organization, legal recipient entity, and stated purpose as separate verification questions.
- Corroborate the entity with an appropriate official registry or filing source, but do not treat a public record as proof of personal authority.
- Independently find a company contact route and confirm the correspondent through a separate channel before increasing disclosure.
- Use staged disclosure and match each stage to documented evidence, permissions, and a human review.
- Pause when identity, entity, authority, or the requested handling of confidential information remains unresolved.
Sources and references
Source retrieval dates record research access, not article publication. Read our editorial and date policy.
- [1] Avoiding Social Engineering and Phishing Attacks · Accessed
- [3] EDGAR Advanced Search · Accessed
- [4] Business Email Compromise · Accessed
Choose your next step
Acquivo is user-operated software. Owners and their professionals remain responsible for decisions, communications, and professional review.
Educational information, not individual legal, tax, or investment advice. Consult qualified professionals for your circumstances. Acquivo provides software, not representation or negotiation on your behalf.