Vendor Quote OSINT: Is the Company Behind the Payment Request?

A quote is a bundle of claims, not one identity

The logo, legal name, website, salesperson and payment instructions may look like one coherent supplier. They are actually separate claims. The document says an organization exists, a domain belongs to it, a person represents it, and a payment destination is authorized. A clean PDF proves only that someone produced a clean PDF.

Start with the decision you need to make. “Is this a real company?” is too broad. A better question is: “Does the legal entity named in this quotation control the stated sales channel and authorize the recipient we have been asked to pay?” That question keeps an impressive website from substituting for payment verification.

Preserve the original quote, message headers or platform URL, delivery time and any later change to the instructions. Do not forward the document to public analysis services if it contains confidential pricing, account details or personal information. Record only the minimum fields needed for the review.

Use a four-box comparison before searching widely

A match in one box does not repair a mismatch in another. A valid registration number can be copied. A real employee name can be placed under a lookalike domain. A legitimate supplier can also use a trading name or a payment processor, so difference is not automatically fraud. The purpose of the grid is to expose the exact relationship that still needs confirmation.

Prefer the source closest to the claim

For legal identity, use the register for the stated jurisdiction. When an organization has a Legal Entity Identifier, the GLEIF LEI Search documentation explains that anyone can search the LEI pool without registration and inspect legal-name, registration-authority and change-history fields. An LEI is useful where available; absence from that system does not mean a company is fake, and a lapsed LEI does not necessarily mean the entity is inactive.

For the website, find the official domain through the register, a regulator, a known contract or another source that did not come from the new salesperson. ICANN’s RDAP page describes the current registration-data protocol for generic domains. Registration age, registrar and redaction can help build a timeline, but none identifies the person who sent the quote.

For payment, operational records usually matter more than public search. Compare the beneficiary with an approved vendor record, earlier paid invoice or independently confirmed instruction. The FTC’s small-business invoice guidance recommends checking unfamiliar invoices and maintaining clear approval procedures. If bank details changed, pause and confirm through a route already trusted before the change arrived.

Separate an explainable difference from a stop signal

Some differences have ordinary explanations: a parent company invoices for a subsidiary, a processor collects payment, or a sales brand differs from the registered name. Ask for the relationship record that explains it. A contract, official partner page, processor disclosure or confirmation through the company’s published switchboard can connect the two entities.

A contradiction is more serious when the new seller controls every source used to explain it. Examples include a registration screenshot with no verifiable record, a contact number found only inside the quote, a new domain that claims decades of history, or a beneficiary that changes after an urgent message. Mark the conflict and the missing independent source. Do not convert it into an accusation.

Fictional case: a familiar supplier name and a different recipient

This example is invented. A quotation from northbridge-components.example uses the name “Northbridge Components” and lists company number NB-2047. The local register shows “Northbridge Components Manufacturing Ltd” at the quoted address. The name and number are consistent, but the register links to a different official domain.

The quote’s domain was registered recently and is not mentioned on the official site. The salesperson’s name appears in an old conference program, yet no current staff page confirms the role. The beneficiary is “Merevale Collections LLC,” a second entity that the quote calls an “approved settlement partner.” That relationship appears only in the quote.

The defensible result is not “the supplier is fake.” It is: “The legal entity exists, but the observed domain and payment recipient have not been independently connected to it. Hold payment until the supplier confirms both through a previously verified channel and provides the contractual basis for the collection entity.” This wording preserves the useful match and the unresolved risk.

Write a decision record, not a pile of search results

List the four boxes, the source used for each, its observation date, the strongest connection and every unresolved contradiction. End with one of three actions: proceed under normal controls, request a specific missing confirmation, or stop and escalate to procurement, finance, legal or fraud response. “No result found” should remain an absence in the sources searched, not proof of nonexistence.

The company OSINT guide helps separate legal entity, website and representative claims. Use the domain guide for a dated web timeline and the investigation report template to preserve the decision trail.

If the quote links several public clues and the relationships remain difficult to review, OSINT Jet can organize the supplied entity, domain, contact and document observations into a report with source notes, confidence and contradictions. It does not validate bank ownership or approve a payment. Review current report options only when the decision needs a structured multi-source case.