Someone new wants to do business with us. What should we actually check before we spend time on them?

Ask for three things, and ask as ordinary onboarding rather than as an interrogation: the legal business name, a physical address, and a website. Genuine buyers and vendors give these up without a second thought, because they are the same details that end up on a quote or an invoice anyway.

Then verify them yourself, and the word yourself is the entire point. Search the company name independently. Do not click the link in the signature, do not call the number in the message, and do not use a contact page you reached through anything they sent. A scammer controls every path that starts inside their own email.

Check that the pieces agree with each other. Does the address correspond to a real place. Does the domain on the email match the website you found on your own. Does the company do the kind of work that would need what they are asking you to price. Individually none of these prove anything, but together they either line up or they do not.

Make one phone call to the number you found. This is the step people skip, and it settles most cases in under a minute, because whoever answers either knows the person you are asking about or does not.

Look at the domain on every message in the thread, including the replies. An opening message from one company's domain and an answer that comes back from an unrelated one is the strongest single signal you will get, and it only shows up if you check the full address instead of the display name.

Run the same check on new vendors, not just new customers. The version of this that costs real money is a fake supplier working its way into your payment process, and the ten minutes are identical.