# Sixtyfour — full text > The substance of https://www.sixtyfour.ai as one document: what the > product is, the published benchmark results in full, and every article, > inline. Generated at build time from the same sources the pages use. > Generated: 2026-10-31 --- ## What Sixtyfour is Sixtyfour is an identity intelligence platform. It deploys AI research agents that investigate a person or company starting from a single identifier — an email address, a name, a phone number, a company or a domain. The agents browse the open web and the dark web, official records and unstructured sources, cross-reference what they find, and resolve it into one profile in which every claim is cited back to the record it came from. The company is Sixtyfour AI Inc., based in San Francisco and backed by Y Combinator. It is SOC 2 compliant. ### How it works 1. **Start with any identifier.** Begin with an email, name, phone number, company, or any other known data point. 2. **Research across sources.** AI agents cross-reference public records, web pages, archives, and documents. 3. **Findings with supporting evidence.** Review the findings, cited sources, and the connections between people and companies. ### Who uses it - **Research API** — a self-serve research API that powers some of the leading data products in the world. - **Fraud and abuse** — sellers, hosts, and merchants at onboarding and at volume, and the rings operating behind them. - **Threat investigations** — threat actors, counterparties, and case subjects. One identifier to full footprint. - **Workforce risk** — candidates and contractors who cleared every verification check and still are not who they claim to be. - **Financial crime** — enhanced due diligence, adverse media, and alert triage with sourcing that holds up in an exam. Demo requests: https://www.sixtyfour.ai/demo. API documentation: https://docs.sixtyfour.ai/introduction --- ## Atlas https://www.sixtyfour.ai/atlas Deep research, with every finding cited Atlas sends a team of AI research agents to look into a person or company. Every fact they find goes on a map that links it to the page it came from. ### How an investigation works 1. **Start with an identifier.** Give Atlas a name, an email, a username or a company, and a research plan if you have one. Choose the engine, a credit budget and a time limit. 2. **Agents work the case.** On XHigh a team of agents researches together, writing what they read to the workspace. A run goes until its budget or time limit, or until its answers are complete. 3. **Findings land on the graph.** Each finding is a node with its source URL and the quote it rests on, scored for how sure Atlas is. The links between findings carry a confidence weight. 4. **Read it, continue it, hand it on.** Open the workspace while the run is still going. Start another run on the same case, generate a PDF report, or export everything as a ZIP. ### Why a finding can be checked - **Every finding cites its page.** A finding carries the URL it was read on and the quote it rests on. "How we got here" retraces the route from your input to the finding, step by step. - **Scored for how sure.** Each finding has a confidence score, shown as a figure and a colour: high from 85, medium from 65, low from 40. Colour is never the only signal. - **Dead ends stay on record.** A lead that did not hold up is marked rejected, not deleted, so you can see what was checked as well as what was found. ### The workspace - **Keep researching.** Run Atlas again on the same case with new instructions. Everything it found before is still there, so each run adds to the last. - **Notes and a live feed.** Read the notes the agents wrote, with any attachments, and follow what they're doing while they work. - **Control who sees it.** Your team can see every case. You can keep a run to yourself, or let another team view or edit a case. ### Engines - **XHigh.** A team of research agents on a frontier model. The deepest research, and the default. - **Scout.** One researcher on a lighter model, with the same tools. Faster and lower cost, and turned on per organization. You also choose how much research to buy, from one unit of the engine's price up to ten, and can set a time limit. When time is up, Atlas writes up what it found. ### API Overview: https://docs.sixtyfour.ai/atlas/overview #### Check access - GET /v1/atlas/access — Check Atlas access: https://docs.sixtyfour.ai/api-reference/atlas/check-atlas-access #### Start research - POST /v1/atlas/investigations — Start an investigation: https://docs.sixtyfour.ai/api-reference/atlas/start-an-investigation - POST /v1/atlas/investigations/{investigation_id}/runs — Continue an investigation: https://docs.sixtyfour.ai/api-reference/atlas/continue-an-investigation #### Follow the agents - GET /v1/atlas/investigations/{investigation_id}/events/stream — Live agent event stream: https://docs.sixtyfour.ai/api-reference/atlas/live-agent-event-stream - GET /v1/atlas/investigations/{investigation_id}/events — Agent event stream: https://docs.sixtyfour.ai/api-reference/atlas/agent-event-stream - GET /v1/atlas/investigations/{investigation_id}/events/{event_id}/payload — Full agent event I/O: https://docs.sixtyfour.ai/api-reference/atlas/full-agent-event-io #### Read the results - GET /v1/atlas/investigations — List investigations: https://docs.sixtyfour.ai/api-reference/atlas/list-investigations - GET /v1/atlas/investigations/{investigation_id} — Get an investigation: https://docs.sixtyfour.ai/api-reference/atlas/get-an-investigation - GET /v1/atlas/investigations/{investigation_id}/graph — Attribution graph: https://docs.sixtyfour.ai/api-reference/atlas/attribution-graph - GET /v1/atlas/investigations/{investigation_id}/findings — List findings: https://docs.sixtyfour.ai/api-reference/atlas/list-findings - GET /v1/atlas/investigations/{investigation_id}/links — List finding links: https://docs.sixtyfour.ai/api-reference/atlas/list-finding-links - GET /v1/atlas/investigations/{investigation_id}/files — List workspace files: https://docs.sixtyfour.ai/api-reference/atlas/list-workspace-files - GET /v1/atlas/investigations/{investigation_id}/file-entries — List workspace file metadata: https://docs.sixtyfour.ai/api-reference/atlas/list-workspace-file-metadata - GET /v1/atlas/investigations/{investigation_id}/files/{path} — Read a workspace file: https://docs.sixtyfour.ai/api-reference/atlas/read-a-workspace-file #### Get the report - POST /v1/atlas/investigations/{investigation_id}/report — Generate the intelligence report: https://docs.sixtyfour.ai/api-reference/atlas/generate-the-intelligence-report - GET /v1/atlas/investigations/{investigation_id}/report — Report generation status: https://docs.sixtyfour.ai/api-reference/atlas/report-generation-status - GET /v1/atlas/investigations/{investigation_id}/report.pdf — Intelligence report PDF: https://docs.sixtyfour.ai/api-reference/atlas/intelligence-report-pdf - GET /v1/atlas/investigations/{investigation_id}/export.zip — Export the workspace as a ZIP: https://docs.sixtyfour.ai/api-reference/atlas/export-the-workspace-as-a-zip #### What is Atlas? Atlas is Sixtyfour's tool for in-depth research on a person or company. AI agents look into the case, save what they read, and put every fact on a map that links back to the page it came from. #### How is it different from People Intelligence? It's the same research underneath. When a People Intelligence call runs on the xhigh tier, or on scout with the graph turned on, it runs Atlas and hands back structured fields. Atlas gives you the whole case instead: the map, the notes and the report. #### How is it priced? You pay in credits each time you start or continue a case, the same as a deep People Intelligence run. You set each run's budget, up to ten units of the engine's price. Reading the results, making reports and exporting aren't charged per request. #### Who can see an investigation? Your team, by default. Whoever starts a run can keep it private, and you can share a case with another team so they can view or edit it. #### How do I get access? We turn Atlas on for each organization. Book a demo and we'll set it up for your team. To check whether you have access, call GET /v1/atlas/access. #### Can I run it from the API? Yes. Everything is under /v1/atlas: starting and continuing research, reading the map and the notes, following the agents live, and getting the report or a full export. --- ## Lattice https://www.sixtyfour.ai/lattice Find patterns across your research Lattice connects the people and companies your team has researched. Review shared identifiers and relationships to uncover patterns across accounts. --- ## Fraud & Abuse Source: https://www.sixtyfour.ai/solutions/trust-and-safety Research infrastructure for Trust & Safety. Sixtyfour connects aliases, public records, and online activity to investigate accounts and map the relationships between them. Find the connections behind an account. Start with an email or username. Sixtyfour researches linked profiles and records to uncover aliases, account history, and connections to other people and businesses. Follow the connections behind a profile. Start with an email or username. Research linked profiles, public records, and business relationships to understand who may be behind a profile and what connects them to others. ### What trust and safety teams use it for - **Financial crime and KYC/KYB** — company profiles resolved against registry, web presence, team and press signals. - **Marketplace risk and seller integrity** — a seller listing counterfeit goods usually operates on several platforms under similar handles; the agents cross-reference them. - **Workforce integrity and verification** — candidates and contractors whose submitted credentials a team cannot fully verify, checked against LinkedIn, university, GitHub and press records. - **Platform abuse and trust and safety** — a suspicious profile investigated through linked aliases, profiles and public records, comparing shared identifiers and activity across accounts to find connections for the team to review. --- ## RECON: A benchmark for researching individuals Source: https://www.sixtyfour.ai/recon-benchmark · HUD results snapshot updated October 10, 2026. This is the snapshot date, not the date of every run. RECON measures how accurately AI systems find and verify facts about real individuals across scattered, unindexed and often conflicting sources. - 140 individuals, chosen across industries, roles and digital-footprint levels, avoiding public figures whose information is too widely indexed to stress-test the benchmark. - 514 human-verified fields. Every field was verified against a primary source with an unambiguous identity link to the person; fields relying on inference were rejected. - 23 systems evaluated. - Scoring is per-field against ground truth, judged by an LLM at 98.5% agreement with human raters. Metrics: **weighted accuracy** (correct minus wrong, divided by all fields), **accuracy** (share of fields answered correctly), **precision** (share of attempted answers that were correct), **recall** (share of the field set answered correctly). Earlier p50 latencies are historical reference only. Latency reference: June 16–17, 2026, not the HUD runs. ### Full results | # | System | Tier / provider | Weighted accuracy | Accuracy | Precision | Recall | Wrong | Earlier p50 (June 2026) | |---|---|---|---:|---:|---:|---:|---:|---:| | 1 | Sixtyfour XHigh | XHigh | 70.6% | 84.4% | 85.9% | 84.4% | 13.8% | — | | 2 | Sixtyfour High | High | 54.3% | 67.7% | 83.5% | 67.7% | 13.4% | 459s | | 3 | Sixtyfour Scout | Scout | 48.4% | 66.3% | 78.8% | 66.3% | 17.9% | — | | 4 | Sixtyfour Medium | Medium | 44.7% | 56.0% | 83.2% | 56.0% | 11.3% | 223s | | 5 | Parallel Ultra 2x | Parallel | 41.1% | 54.3% | 80.4% | 54.3% | 13.2% | 834s | | 6 | Parallel Ultra 8x | Parallel | 37.5% | 52.1% | 78.1% | 52.1% | 14.6% | 678s | | 7 | Grok 4.20 multi-agent | xAI | 36.2% | 51.6% | 77.0% | 51.6% | 15.4% | — | | 8 | Grok 4.6 | xAI | 36.0% | 50.8% | 77.4% | 50.8% | 14.8% | — | | 9 | Grok 4.3 | xAI | 30.9% | 44.9% | 76.2% | 44.9% | 14.0% | — | | 10 | Sixtyfour Low | Low | 28.8% | 49.8% | 70.3% | 49.8% | 21.0% | 230s | | 11 | Parallel Ultra | Parallel | 27.2% | 43.4% | 72.9% | 43.4% | 16.1% | 589s | | 12 | Kimi K3 (max) | Moonshot | 27.0% | 36.0% | 80.1% | 36.0% | 8.9% | — | | 13 | Claude Opus 5.5 (xhigh) | Anthropic | 26.3% | 32.9% | 83.3% | 32.9% | 6.6% | — | | 14 | GPT-6 Astra (max) | OpenAI | 25.1% | 28.0% | 90.6% | 28.0% | 2.9% | — | | 15 | Exa agent xhigh | Exa | 23.9% | 37.7% | 73.2% | 37.7% | 13.8% | — | | 16 | GPT-6.1-sol max | OpenAI | 23.0% | 27.8% | 85.1% | 27.8% | 4.9% | — | | 17 | GPT-5.6-sol xhigh | OpenAI | 20.4% | 31.3% | 74.2% | 31.3% | 10.9% | — | | 18 | Gemini 3.1 Pro (high) | Google | 13.4% | 23.2% | 70.4% | 23.2% | 9.7% | 87s | | 19 | Claude Sonnet 5 (xhigh) | Anthropic | 12.6% | 20.0% | 73.0% | 20.0% | 7.4% | — | | 20 | DeepSeek V4 Flash (high) | DeepSeek | 12.5% | 18.7% | 75.0% | 18.7% | 6.2% | — | | 21 | DeepSeek V4 Pro (high) | DeepSeek | 12.3% | 18.9% | 74.0% | 18.9% | 6.6% | — | | 22 | GLM 5.3 (max) | Z.AI | 3.7% | 13.8% | 57.7% | 13.8% | 10.1% | — | | 23 | Claude Haiku 4.5 | Anthropic | 1.6% | 7.6% | 55.7% | 7.6% | 6.0% | — | Additional supplied results are unranked pending verification of their incomplete denominators: - Claude Opus 5: 49 correct / 39 wrong / 414 missing (502 total). - Claude Fable 5: 14 correct / 9 wrong / 421 missing (444 total). [Historical April results, on a different dataset](https://www.sixtyfour.ai/research/recon/2026-04-results.json). --- ## Articles ### How to do due diligence on a person *Who someone is, the companies they have run and how those ended, what the courts and the press have recorded, and what they left out. How to research the person behind a counterparty from public records, and how to weigh what you find.* Source: https://www.sixtyfour.ai/blog/how-to-do-due-diligence-on-a-person Saarth Shah · 2026-10-28 · Trust & Safety To do due diligence on a person, start from the decision their background could change, confirm who they are before you collect anything, and then test what they say about themselves against records they did not write: business registries for the companies they ran and how those ended, court records, news coverage and their public footprint over the years. Then look for anything material they left out, put it to them directly, and write up each finding with its source and how confident you are. The result is a short file a decision-maker can check. This guide is about business due diligence from public records. It is for investors, corporate development and partnerships teams, investigators and financial institutions researching the people behind a counterparty, and for founders checking an investor or a prospective co-founder. It is not a consumer background check. Our guides to [identity resolution](https://www.sixtyfour.ai/blog/what-is-identity-resolution) and [verifying a resume](https://www.sixtyfour.ai/blog/how-to-verify-a-resume) go deeper on two of the steps. #### Why research the person behind a company? The people at the top of a counterparty decide how it treats you. The Association of Certified Fraud Examiners' [2026 study](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf) covers 2,402 cases of occupational fraud, in which people defrauded the organisations they worked for, investigated between January 2024 and September 2025. Frauds by owners and executives were 16 percent of the cases but caused a median loss of $475,000, more than nine times the median for frauds by employees. They also ran longer before they were caught: a median of 23 months, against eight for employees. Most of what you need is already public. Anyone who has run companies, sat on boards or raised funds leaves filings behind, and often coverage, interviews and court records too. A registry entry, a court docket and an archived web page were each written by someone else at the time, which is what makes them worth checking a story against. #### How do you decide what to check? Write down the decision first, then the questions that could change it. An investor about to join a founder's board needs to know whether the founder's account of their career holds up, how their earlier companies ended, and whether anything suggests they would treat investors or creditors unfairly. A partnerships team signing a referral agreement needs much less. A question whose answer could not change the decision is out of scope. Then set the scope: - Who: the person and the companies they have run. Relatives and associates come in only where a question needs them. - How far back: far enough to cover the career the decision rests on, often the last ten years for someone running a company, and every company named in their pitch. Registries set limits of their own. Companies House's [free service](https://www.gov.uk/guidance/searching-the-companies-house-register) holds every company dissolved since January 2010, and its policy is to keep dissolved companies' records for 20 years, though it has paused destroying or transferring records while it [reviews that period](https://www.gov.uk/government/news/companies-house-is-reviewing-the-retention-period-for-dissolved-company-records). - Where: every country and state where the person has lived or done business, because registries and courts keep local records. #### How do you make sure you have the right person? Resolve the identity before you collect anything, because a search on a name returns everyone who has it. In the 2020 Census, [258 last names](https://www2.census.gov/library/publications/decennial/2020/c2020br-14.pdf) covered a quarter of the US population. A record about a namesake, whether a court case, an old company or a news story, can attach itself to the wrong file and colour everything you read after it. Start from what you know for certain: the person's full name and any former names, the companies they say they have run, the cities they have lived in, a work email address and a photo. Treat a new record as theirs only when two independent details agree, such as a name and a company, or a name and an address at the same date. Companies House [shows the month and year of birth](https://www.gov.uk/guidance/removing-your-home-address-from-the-companies-house-register) of each director on its public register, which is often enough to separate two people with the same name. Keep a list of the namesakes you set aside and why, so nobody adds them back later. Our guide to [identity resolution](https://www.sixtyfour.ai/blog/what-is-identity-resolution) explains how much each identifier is worth and what to do when two records conflict. #### How do you check someone's company roles and history? Business registries record, to different degrees, who ran a company, when they joined and left, and what happened to the company. In the UK, Companies House lets anyone [search officers](https://www.gov.uk/guidance/searching-the-companies-house-register) for free and see a company's current and resigned officers. An officer's list of appointments gives each company the person has been appointed to, the dates they were [appointed and resigned](https://developer-specs.company-information.service.gov.uk/companies-house-public-data-api/resources/appointmentlist?v=latest), and the company's status, such as active, dissolved or in liquidation. Open each company's filing history too, for its accounts, its changes of officers and how it closed. How a company ended tells you more than the fact that it ended. A company that can pay its bills [can be closed](https://www.gov.uk/closing-a-limited-company) by having it struck off the register or through a members' voluntary liquidation. A company that cannot pay its debts can go into a creditors' voluntary liquidation or a compulsory liquidation through the courts, [among other routes](https://www.gov.uk/liquidate-your-company). The status and the filing history show which route a company took, and the person's resignation date shows whether they were still a director when it happened. Read a filing as what the company told the registry on that date. Companies House checks that each filing is complete, but [says](https://www.gov.uk/guidance/searching-the-companies-house-register) it receives so many documents that "a close review of each document during registration is not always possible." In the US, each state runs its own registry, and the National Association of Secretaries of State [links to them](https://www.nass.org/business-services/corporate-registration). What they publish varies: Delaware's [free search](https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx) gives an entity's name, file number, formation date and registered agent, and more costs a fee. Two federal sources reach further. EDGAR's [full-text search](https://www.sec.gov/edgar/search/efts-faq.html) covers every filing made electronically with the SEC since 2001, attachments included, so a name in quotation marks finds the filings that mention a person. And a company that raised money in certain private offerings may have filed a [Form D](https://www.sec.gov/files/formd.pdf), whose related persons section names its executive officers, directors and promoters. #### How do you check what they say about their track record? Write the person's account down as a list of claims, then check each claim against a record they did not write. "Founded and sold a freight software company in 2021" is three claims: a founding, a role and a sale. - Roles and dates: the registry, archived team pages, conference programmes and filings that name them. - A sale: the buyer's own announcement, and the sold company's filings after the date. A sale of the company and a liquidation leave different marks on the register. - Degrees, licences and certifications: the school's registrar or the body that issued them, which our guide to [verifying a resume](https://www.sixtyfour.ai/blog/how-to-verify-a-resume) covers claim by claim. - Numbers such as revenue, customers or returns: filed accounts where they exist, and people who were there. Mark each claim as confirmed, contradicted or open, and note how far the record and the story differ. A rounded-up customer count and an invented exit are different findings. #### How do you search court records on a person? Search the courts where the person and their companies have lived and done business, then read the records themselves. In the US, federal court records are on PACER. Its [Case Locator](https://pacer.uscourts.gov/help/faqs/what-pacer-case-locator) is a national index for the district, bankruptcy and appellate courts, and a search returns each case's party names, court, number and the dates it was filed and closed. PACER [waives fees](https://pacer.uscourts.gov/pacer-pricing-how-fees-work) for anyone who spends $30 or less in a quarter. Most cases, though, are in state courts. The federal district courts received [382,692 civil cases and criminal defendants](https://www.uscourts.gov/data-news/reports/statistical-reports/judicial-business-united-states-courts/judicial-business-2025) in the year to September 2025. The National Center for State Courts counted about [70 million state court filings](https://www.ncsc.org/resources-courts/data) in calendar 2024, a count that takes in traffic, family and juvenile cases as well as civil and criminal ones. In England and Wales, bankruptcies, debt relief orders and individual voluntary arrangements are on the [Individual Insolvency Register](https://www.gov.uk/search-bankruptcy-insolvency-register), which can be searched by name, but records are usually removed within three months of a case ending. Older bankruptcies may be found in [The Gazette](https://www.thegazette.co.uk/about), the UK's official public record, which publishes [insolvency notices](https://www.thegazette.co.uk/insolvency) such as bankruptcy orders, discharges from bankruptcy and resolutions for voluntary winding-up. Then read the record, starting with the docket, which the US federal courts' [glossary](https://www.uscourts.gov/glossary) defines as "a log containing the complete history of each case". A civil complaint states "the wrongs allegedly committed by the defendant", which is one side's account, and a judgment is "the official decision of a court finally resolving the dispute". Most civil cases end before anyone tests the allegations at trial: of the 298,208 civil cases that ended in the federal district courts in the year to June 2026, [0.5 percent](https://www.uscourts.gov/data-news/data-tables/2026/06/30/statistical-tables-federal-judiciary/c-4) reached trial. Note who sued whom, over what, how it ended, and whether the person was a party or only named. #### How do you read news and adverse media about a person? Resolve the identity first, then read what the story says the person did. Our guide to [adverse media screening](https://www.sixtyfour.ai/blog/adverse-media-screening) follows a single hit through four decisions: whether the article is about your subject, what part they play in it, how far the matter got and whether it matters for the relationship. Look for the rest of the story as well. The Society of Professional Journalists' [code of ethics](https://www.spj.org/spj-code-of-ethics/), revised in October 2026, asks journalists to "gather, update and correct information throughout the life of a news story" and to "acknowledge mistakes". A charge may have been dropped or a detail corrected in a later piece, so search for follow-ups and corrections before you rely on the first story. And count sources: several stories that all rest on one press release are one source. #### How do you check a person's public footprint over time? Look at how the person has described themselves over the years, in archived team pages, conference programmes, interviews and profiles, and at how others have described them, each with a date. The Internet Archive's [Wayback Machine](https://web.archive.org/) lets you search the history of more than one trillion web pages, so a former employer's team page from 2018 may still be there after the company has gone. It does not hold everything: the Internet Archive [says](https://help.archive.org/help/wayback-machine-general-information/) it does not archive pages that need a password, and that some pages are missing because of robots exclusions or a site owner's request. Read the footprint for consistency. A real career builds up a record across years, written by different people, whose titles and dates agree. A biography that changes from one conference to the next, a former employer that never mentions the person, or a footprint that begins the year the fundraising did are questions to put to them. #### How do you write up the findings? Write each finding with its source, its date and how confident you are in it, and keep three groups apart: what the records confirm, what they contradict and what is still open. Our guide to [running an OSINT investigation](https://www.sixtyfour.ai/blog/how-to-run-an-osint-investigation) shows how to state confidence in words a reader will take the way you meant them. Keep only what bears on the decision. The Berkeley Protocol on Digital Open Source Investigations, published by the UN human rights office and the Human Rights Center at UC Berkeley, says that online content "should only be collected if it is relevant to a particular investigation" ([PDF](https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf)). A person's health, family or politics will rarely bear on a business decision, and leaving them out keeps the file fair. Then put the material findings to the person before anyone decides, since there is often an ordinary explanation the records cannot show. Journalists hold themselves to the same courtesy: the SPJ code asks them to give the subjects of news coverage a "fair opportunity" to respond to allegations of wrongdoing. Record the answer as the person's own account, and check what you can of it. #### A worked example The case is a composite. Maren Edrecott, Martin Edrecott, Esterlow Systems and Ebberwick Freight are invented, and the domain uses the .example name [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606). A seed-stage venture fund in New York is about to lead a $3 million round in Esterlow Systems Inc., a Delaware company that builds pricing software for freight brokers. Its founder, Maren Edrecott, moved from Manchester to New York in 2023. The deck says she founded Ebberwick Freight in the UK in 2016, grew it to 40 customers and sold it in 2021, after four years in operations at a large logistics group. The scope. The decision is whether to lead the round and take a board seat. The questions are whether her account holds up, how Ebberwick ended, and whether anything since 2016 bears on how she treats investors, customers and creditors. The fund holds her name, her email address, maren@esterlow.example, her professional profile and the deck. Her family and her personal finances are out of scope, apart from any insolvency record. The identity. A Companies House officer search for her name returns two people. One, born in April 1987, was a director of Ebberwick Freight Ltd. The other, born in 1958, is a director of a property management company in Norwich, shares nothing else with the first, and goes on the list of namesakes set aside. The roles. Her list of appointments shows her as a director of Ebberwick from its incorporation in March 2016 until she resigned in June 2021. Ebberwick's status is dissolved. Its filing history shows a resolution in March 2022 to wind the company up in a creditors' voluntary liquidation, the route for a company that cannot pay its debts, and its dissolution in 2024. The deck does not mention the liquidation. The track record. Archived copies of Ebberwick's team page from 2017 to 2020 list her as co-founder and chief executive, as does a 2019 conference programme. The logistics group's archived staff pages from 2012 to 2015 list her in operations. The courts. In the PACER Case Locator, the surname returns one case, a 2019 case in Ohio naming a Martin Edrecott, which is set aside. The company's name returns a 2024 case in the Southern District of New York, brought by a former customer against Esterlow Systems Inc. over a billing dispute, to which she is not a party. The docket shows a complaint, an answer and a stipulation of dismissal five months later, so the allegations were never tested. The New York state courts and the Individual Insolvency Register have nothing on her, and The Gazette carries Ebberwick's winding-up notices and nothing about her personally. The news. A 2022 trade press story about Ebberwick's collapse called her its chief executive at the time. The publisher corrected it later that month to say she had left in 2021, which matches her resignation date, and the Wayback Machine holds the story as it first ran. The conversation. The partner puts the liquidation and the lawsuit to her on a call. She says that in 2021 Ebberwick sold its software and customer contracts to a larger UK logistics company, which hired her for a year, and that what was left of the business, owing a large debt to a haulier after losing its biggest customer, was wound up the next year, with her co-founder still a director. To her it was a sale of what she had built. She sends the asset purchase agreement, and the buyer's 2021 announcement of the purchase, still in the archive, names her as joining. The lawsuit, she says, was settled for a small sum, and the settlement goes into the data room. Put together, the records support her account of her roles and dates, and contradict one word in the deck. What she called a sale was a sale of the business's assets, followed by the insolvent liquidation of the company she founded, after she had left it. The fund leads the round. It asks her to describe Ebberwick accurately in the materials for co-investors, reviews the settlement as part of its diligence on the company, and calls two of Ebberwick's former customers, since no record shows the customer count. One question stays open, and the file says so: why Ebberwick lost its biggest customer. The fund has only her account of that, because her former co-founder did not reply before the round closed. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Registry officer record | The person was a director of these companies between these dates, and how each company ended | What they did there, or why a company failed | | Month and year of birth on the register | Whether two officer records with one name belong to two people | A full identity | | EDGAR search and Form D | Filings that name the person, and their roles in companies that raised money | Anything the filings leave out | | Federal and state court records | Cases the person or their companies were party to, and how each one ended | Whether contested allegations were true, or disputes settled before anyone filed | | Insolvency register and The Gazette | A current or recent personal insolvency in England and Wales, and older insolvency notices | Insolvencies in places you did not search | | News coverage | What was reported, and whether it was later corrected | Whether an allegation was proved | | Archived pages and footprint | How the person described their career at the time | Whether those descriptions were true | | The person's own account | Their explanation of what the records show | Anything they choose to leave out | Two records count as two only if neither was copied from the other. #### What defeats these checks - A different name. People change their names, use initials or spell a name more than one way, and companies trade under names other than their registered ones. Companies House lists an officer's [former names](https://developer-specs.company-information.service.gov.uk/companies-house-public-data-api/resources/appointmentlist?v=latest) where they were given, but a search on a current name alone can miss earlier records. - Someone else's name on the filing. A person who runs a company through a relative, a friend or a nominee may not appear in its officer records. - Disputes that never reached a court. A claim settled before anyone filed it leaves no court record to find. - Places with thin public records. Some countries publish little about their companies or court cases online, and a clean search there tells you less. - A clean record. In the ACFE's study, 88 percent of the perpetrators had no known history of fraud-related charges or convictions. Court and insolvency searches show what has already happened, and say little about what someone will do next. - A footprint built to order. Profiles and articles can be produced for the occasion, so weight records other people made at the time. #### Reading the evidence fairly Most of what looks troubling in a person's record has an ordinary explanation, and a fair review checks it first. - Namesakes. A record that matches only on a name is a lead until a second, independent detail agrees. - Companies close for ordinary reasons. The Office for National Statistics found that [38.4 percent](https://www.ons.gov.uk/businessindustryandtrade/business/activitysizeandlocation/bulletins/businessdemography/2024/pdf) of UK businesses born in 2019 survived into 2024. A dissolved company, or even an insolvent liquidation, is a fact about a business. What matters is how the person behaved while it happened, and how they describe it now. - A lawsuit is an allegation. The federal courts' glossary says settlements "usually do not include the admission of fault", and a case can be dismissed for many reasons. Read how a case ended before you count it. - Most bankruptcies are about consumer debt. In the year to September 2025, about 96 percent of US bankruptcy petitions were [nonbusiness petitions](https://www.uscourts.gov/data-news/reports/statistical-reports/judicial-business-united-states-courts/judicial-business-2025/us-bankruptcy-courts-judicial-business-2025), filed primarily by individuals with mainly consumer debt. Weigh one by what it says about the decision in front of you. #### Where Sixtyfour fits Much of the work in researching a person is telling namesakes apart and keeping each record tied to its source. Sixtyfour's agent starts from what you already have, such as a person's name, an email address, a company name or a website, researches public sources such as registry filings, public records, news, professional profiles and the web footprint, links what it finds to the right person and companies, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not run consumer background checks or credit reports. There is more on how investigators use it on our [investigations page](https://www.sixtyfour.ai/solutions/investigations). #### The short version Decide what the research is for, confirm who the person is, and test their account of their career against records they did not write: the registries for the companies they ran and how those ended, the court records, the news and their footprint over the years. Put anything material they did not mention to them directly, and write up each finding with its source, its date and how confident you are, keeping only what the decision needs. --- ### How to find out who is behind a fake account *Attribution from public evidence means building links between an account and a known identity and saying how strong each one is. Where to look, what each link proves, why you work passively, and when to hand your evidence to the platform.* Source: https://www.sixtyfour.ai/blog/how-to-find-out-who-is-behind-a-fake-account Hashim Khawaja · 2026-10-27 · Trust & Safety To find out who is behind a fake account, build links from the account to a known identity using public evidence, and say how strong each link is. Start with what the account shows about itself, then trace what it reused: photos, handles, any email address, phone number or website it published, and sibling accounts from the same campaign. Public evidence can often tie an account to the operator's other accounts and handles with real confidence. Naming the person usually takes the platform, which holds the account's registration and log-in data, or law enforcement where there are threats or extortion. This piece is for trust and safety, fraud and brand protection teams dealing with impersonation, scam profiles and coordinated fake accounts. It covers each check, what it proves, when to stop, and a worked example. Our guides to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts), [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) and [running an OSINT investigation](https://www.sixtyfour.ai/blog/how-to-run-an-osint-investigation) go deeper on individual steps. #### Why is attribution a question of links? In 2025, nearly 30 percent of people who reported losing money to a scam said it started on social media, with reported losses of $2.1 billion, according to the [FTC's April 2026 data spotlight](https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2026/04/reported-losses-scams-social-media-eight-times-higher-2020). Scammers, it notes, "might hack into your account to scam your friends or even create entirely fake profiles." Imposter scams were the most reported fraud category that year, and people reported losing nearly $1 billion to business impersonators, the FTC [said in June 2026](https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025). Meta's [August 2026 adversarial threat report](https://transparency.meta.com/sr/H2-2026-adversarial-threat-report/) adds that scam operators "now increasingly pose as local professionals and trusted community figures". "Who is behind this account" can mean three questions, and public evidence answers them with falling confidence. 1. Which other accounts does the same operator run? Shared photos, text, domains, creation dates and followers often answer this well. 2. What other names does the operator use? A rare handle or a contact detail reused elsewhere can answer this. 3. Who is the person? That needs a link that does not rest on anything the operator wrote, and public evidence often runs out here. Most teams need only the first two to act: to report a cluster, warn customers or take down a lookalike domain. #### How do you investigate an account without alerting it? Work passively: read what is public and leave the account alone. Our practice is no messages, no follow or friend requests, no replies, no attempts to trick the operator into revealing something, and no invented accounts used to follow it or win its trust. The [Berkeley Protocol on Digital Open Source Investigations](https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf), from the UN human rights office and the University of California, Berkeley's Human Rights Center, treats information acquired from internet users "through communication with those users" as closed source. It recommends that investigators view open-source material through virtual identities, so that their real identity stays hidden, and says these should not be used to reach content behind access controls, or "as a pretext to elicit information directly from a person under the pretences of a false identity", which would take the work outside open-source investigation. Leave password reset and account recovery forms alone too. Using one to glimpse a masked email address or phone number can alert the account holder: Facebook sends a reset email, and its [help centre](https://www.facebook.com/help/226272054050348) explains what to do about one "that you didn't request". An operator who knows they have been noticed can delete accounts or change handles before you finish. Save every profile, post and message you rely on with its address and capture time, because a reported account may disappear. If the account is threatening you, the FBI's [advice on threats](https://www.fbi.gov/investigate/counterintelligence/threat-intimidation-guide) made by message or on social media starts the same way: "Don't delete the messages", record the date, time and sender, "Preserve all electronic evidence", and notify law enforcement. #### What does the account show about itself? Some platforms now publish part of an account's history. On Instagram and Threads, [About this account](https://www.facebook.com/help/instagram/697961817256175) shows the date the account joined and how many times its username has changed, "but not the former usernames themselves". For certain accounts it can also show the country the account is based in and "other public accounts that have the most followers in common". On a public X account, About this account opens from the joined date and shows a country or region that [X infers itself](https://help.x.com/en/managing-your-account/how-to-change-country-settings). Our guide to [telling whether a LinkedIn profile is fake](https://www.sixtyfour.ai/blog/how-to-tell-if-a-linkedin-profile-is-fake) covers LinkedIn's equivalent panel. Those fields describe history, and history can be prepared. Meta's report describes about 575,000 "predominantly dormant accounts mass-produced in Pakistan", which it assesses "were likely warehoused as pre-aged inventory", and a network originating in Russia whose operators "activated dormant Pages" and "renamed them simultaneously just prior to launching their campaigns." An old account with a fresh name and a new purpose may have changed hands. Then read the rest: where the bio links go and how old the destination is, the first posts from before the account had an audience, the first accounts it followed where the platform shows them, and when and how it posts. #### What do posting times and writing style suggest? Posting times can hint at where an operator lives, because people sleep. A [May 2026 preprint](https://arxiv.org/abs/2605.04371) by researchers at Sapienza University of Rome estimated the time zones of Reddit communities from hourly activity alone, assuming activity reaches its minimum "around 4 a.m. local time", and recovered the correct zone "within a one-hour margin on average". The authors stress that their method "makes no claims about the location of individual users". One account gives far less data and a time zone spans many countries, so treat a quiet window as a weak lead. Writing habits are weaker still on their own. In a [2012 study](https://www.cs.princeton.edu/~arvindn/publications/author-identification-draft.pdf), researchers at Stanford and Berkeley used writing style to match a sample of three blog posts to the right blog among 100,000 in about 20 percent of cases, and to a different blog by the same author in about 12 percent. Shared spelling and phrasing can support a link that already rests on something specific, and cannot carry one alone. #### Where did the profile photo come from? Run every image the account uses through a reverse image search. A search engine's [search by image](https://support.google.com/websearch/answer/1325808) can return "Websites with the image or a similar image", and Google's [About this image](https://support.google.com/websearch/answer/14177408) panel, available in some regions, can show "When Google may have first seen a similar version of the image" and pages where it appeared "much earlier than other results". There are three outcomes. - The photo appears on older pages under another name. The account very likely took it, and the person pictured is usually a victim. - The photo is a stock image. X's [authenticity policy](https://help.x.com/en/rules-and-policies/authenticity) lists "stock, stolen or AI-generated profile photos" among the marks of a fake persona, and a stock match shows the account did not use its own photo. - Nothing matches. That fits a real person whose photo is not posted elsewhere and a generated face equally well. Meta reports that "synthetic profile photos" remain prevalent in influence operations, and that every coordinated inauthentic behaviour network in its August 2026 report used some form of generative AI it could identify. A photo is evidence about the account. It says something about the operator only when the same image turns up on other accounts and links them. #### Is the handle used anywhere else? Search the handle and display name, exactly and with small variations, on other platforms, forums, code sites, marketplaces and archived pages. A reused handle is worth as much as it is unusual. A [2011 study](https://arxiv.org/abs/1101.5578) by researchers at INRIA in France found that predictable usernames are far more likely to be picked by several people, while unusual ones "refer in the vast majority of the cases to unique users." A first name and a birth year link almost nothing, and a long, odd string used for years in one niche links a great deal. Date every appearance. The Internet Archive's [Wayback Machine](https://help.archive.org/help/using-the-wayback-machine/) lets you search archived pages by address and date range, though not every page was captured. A handle on a page from 2021 shows it was in use then, and says nothing about who controls it now. Handles also move. Researchers at Indiana University's Observatory on Social Media [found coordinated accounts](https://arxiv.org/abs/2001.05658) on Twitter passing handles among themselves, and noted that "an account changing its handle might be normal, but a group of accounts switching their names in rotation is unlikely to be coincidental." Check that a handle belonged to the same account for the whole period you rely on. #### What has the account published about itself? Anything the operator had to set up and control is stronger evidence than anything they could copy: a website in the bio, an email address in a message, a phone number on a landing page, a payment link. ICANN's [Lookup tool](https://lookup.icann.org/en) shows a domain's current registration data, which for a generic domain such as .com includes the date it was registered. A domain created days before the account, with a name that echoes the brand being impersonated, belongs in the file. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) works through what an address can show. A bio can also carry a real person's name, company or email address, so check that a detail is in use by the operator, in an earlier message or on a page they control, before you lean on it. #### Is the account part of a campaign? Many fake accounts work in groups. Meta defines coordinated inauthentic behaviour as "coordinated networks of Meta assets working together to mislead people using false identities". Look for signs you can see from outside: - the same images, including cropped or recoloured versions; - the same bio text, post text or link format; - creation dates clustered in a short window; - the same followers, or accounts that follow, like and reply to each other and little else; - the same destinations, such as domains registered together or pages built from one template. The Indiana University researchers built coordination networks from traces like these, and their cautions apply to manual work. "Sharing the same image many times is a stronger signal than sharing it just once", shared memes are "not necessarily suspicious if those memes are very popular", and the authors "recommend a manual inspection of the suspicious clusters and their content." Our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) explains how to weigh each shared value and why two links drawn from one fact count once. #### How confident do you need to be before you act? Match the action to the evidence. Several specific, independent links can support a report to the platform, a warning to customers or a complaint to a domain's registrar. A link from that cluster to a named person needs more, because a wrong name lands on someone who did nothing. Public evidence is often enough to show that several accounts share one operator, and rarely enough on its own to say who that operator is. After the Boston Marathon bombing in April 2013, Reddit's general manager [apologised publicly](https://web.archive.org/web/20130502000647/http://blog.reddit.com/2013/04/reflections-on-recent-boston-crisis.html) because activity on the site "fueled online witch hunts and dangerous speculation which spiraled into very negative consequences for innocent parties." The post said "let's find out who this is" events "frequently result in witch hunts, often incorrectly identifying innocent suspects". Write each link with its source, its date and what would make it wrong. The Berkeley Protocol notes that accuracy is often improved through "testing of multiple working hypotheses" and says "Analytical conclusions should not be exaggerated or overstated." Keep a name out of the record unless the decision needs it: the Protocol's data minimisation principle says online content "should only be collected if it is relevant to a particular investigation." #### When should you stop and hand over? Stop when the next step would need contact with the account, access you do not have, or a guess. The platform can see what you cannot: the details the account was registered with and the record of how it logs in. Instagram's country field, for example, is based on "an account's activity", which only Instagram holds. Report through the platform's own tools, with your evidence attached. - Facebook says profiles and Pages that impersonate other people "aren't allowed on Facebook", and you can [report one](https://www.facebook.com/help/174210519303259) "even if you don't have a Facebook account." - Instagram lets you [report an account in the app](https://www.facebook.com/help/instagram/1291391774792379) for pretending to be you, someone you follow, a public figure or a business. For an account impersonating you, it [responds only](https://www.facebook.com/help/instagram/370054663112398) to reports from that person "or a representative of the person who's being impersonated", with a photo of a government-issued ID. - X takes reports through its in-app reporting flow, and links a report form for an account "posing as you or your brand." Bring in law enforcement for threats, extortion and money lost. The FBI says to call 911 if you are in immediate physical danger, and to report "an ongoing crime, threat to life, or national security threat" through its [online tip form](https://tips.fbi.gov/) or a local field office, and points people to local police for incidents below its threshold. Its [cyber page](https://www.fbi.gov/investigate/cyber) asks victims of a "cyber-enabled crime or fraud" to file with its Internet Crime Complaint Center (IC3) "as soon as possible". #### A worked example The case is a composite. Rathmorrow, Helena Rauchwell and the handle trellisfox are invented, and the domains use the .example names [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606). Rathmorrow sells scheduling software to clinics. In September 2026 two customers forward messages from an account using the name and photo of Helena Rauchwell, its head of customer success, offering a discount for renewing early through a billing portal at rathmorrow-billing.example. Rathmorrow's own domain is rathmorrow.example, and it never takes payment through a third party. Its trust and safety lead saves everything with addresses and capture times, and nobody replies to the account. The account. Its About this account panel shows it joined five weeks earlier and has changed its username twice. Its first posts repost Rathmorrow's announcements, it mostly follows staff at Rathmorrow's customers, and its messages went out between 22:00 and 04:00 Rathmorrow time, a weak hint of a working day several hours ahead. The photo. A reverse image search finds Helena's real headshot on Rathmorrow's team page, where it has been since 2022. The domain. A registration lookup shows rathmorrow-billing.example was created two days before the account. The cluster. The shared-followers panel and a search for the account's bio wording turn up three more accounts, each impersonating a customer success lead at another software company. All were created within the same nine days, each links to its own billing domain registered that week from one page template, and all four are followed by the same 38 recently created accounts that follow little else. These links are specific and independent, so the team rates it very likely that one operator runs all four. The handle. A customer's screenshot from the account's first week shows an earlier username, trellisfox. That handle has posted since 2021 on a public marketplace forum, selling ready-made business profiles, and one of its posts shows the billing sites' template. The handle is unusual and the template specific, so the team rates it likely that the operator also uses trellisfox. The forum profile gives a first name and a city, and a person with that name lives there, but nothing ties them to the handle except details the operator wrote. The team stops and keeps that person out of the file. The action. Helena files the impersonation report herself, since a platform may ask the person impersonated for proof of identity, and attaches the evidence. The brand team reports the other three accounts and the domains, alerts the other companies, and emails customers from Rathmorrow's own domain to say staff never take payment through a new portal. One customer had already paid $18,400 through the portal, so it calls its bank and files a complaint with the IC3. The file states what is established, how strongly, and what is open: who uses trellisfox. The platform, which holds the accounts' registration and log-in data, can go further. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Creation date and username changes | How long the account has existed and how often it was renamed | That it was not bought, prepared in advance or taken over | | Image match on older pages under another name | The photo very likely belongs to someone else | Who took it | | No image match | Nothing either way | That the face is generated | | Posting times | A rough working day, given enough activity | A country, or that one person posts | | Writing habits | Support for a link that already rests on something specific | An identity | | A rare handle reused elsewhere, with dates | The same operator probably uses both names | Who the operator is, or who controls the handle today | | A published website, email address or phone number | A contact point the operator controls, and how old it is | That a name in its records is the operator's | | Shared images, text, creation dates, followers and domains | Several accounts are probably run together | Who runs them | #### What defeats these checks - Bought and prepared accounts. An old creation date can be bought or grown in advance, which is what Meta assesses its 575,000 dormant accounts were likely for. - Generated personas. A face never posted anywhere leaves image search silent, and Meta describes accounts "featuring AI-generated profile photos and videos of the same fictitious personas", with generated bios and articles to match. - Separation. An operator who uses a fresh handle, domain, photo and set of followers for every account leaves few links between them. - Planted leads. A bio can name a real person, a stolen photo shows a real person, and a handle can be borrowed from someone else's old account, each pointing at someone innocent by design. - Tools. Scheduled posts move posting times, and translation tools flatten style. The links that hold up best are things the operator had to set up and keep using: domains, templates, long-lived handles and accounts that move together. #### Reading the evidence fairly Most odd-looking evidence has an ordinary explanation, and a fair review checks it first. - Stock and shared photos. Many people and businesses use the same stock images, and the person in a stolen photo is a victim. A shared image counts only when it is rare and comes with other links. - Common names and handles. In the [2020 Census](https://www.census.gov/topics/population/genealogy/data/2020_names.html), 2,369,644 people in the US were recorded with the surname Smith, and short handles built from names and years collide constantly. A match needs a second, independent detail. - Accounts that were taken over. Scammers hack real accounts to scam their owners' friends, as the FTC notes, and the owner of a hijacked account is a victim. When an old account suddenly changes its name, photo or purpose, check for that first. - Parody and fan accounts. X allows labelled "Parody, Commentary, and Fan (PCF)" accounts that say "parody", "fan" or similar in the name and bio, a different matter from an impersonator. - Several accounts, one honest person. X lets people operate "up to ten (10) accounts for different, non-duplicative purposes", so one person running several accounts is ordinary. - Time and language. People travel, work nights and schedule posts, and many write in a second language. So keep three levels apart. A lead is a reason to look further, a link is a specific, dated connection with a source, and an attribution to a person needs several independent links and usually belongs to the platform or to law enforcement. #### Where Sixtyfour fits Following a handle, a domain and an email address across the open web by hand is slow. Sixtyfour's agent starts from an identifier you already have, such as a handle, a name, an email address, a phone number or a website an account published, researches public sources, links what it finds to the right person or company, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides what to report and to whom. It does not see a platform's account data, so who registered an account and how it logs in stay with the platform. Our [investigations page](https://www.sixtyfour.ai/solutions/investigations) has more. #### The short version Build links from the account to an identity one at a time, from what it shows about itself, what it reused, what it published and which accounts it moves with, and rate each link by how specific and independent it is. Work passively, keep the levels of attribution apart, and keep a name out of the record until the evidence for it is strong. When the next step needs contact, access or a guess, hand your evidence to the platform, or to law enforcement if there are threats, extortion or money lost. --- ### Business identity theft: how to spot a hijacked company *Fraudsters can borrow the identity of a real company, including old and dormant ones, to get credit, open accounts or redirect payments. How the hijack works, the signs in a filing history, a domain and a footprint, and what to do if it is your company.* Source: https://www.sixtyfour.ai/blog/business-identity-theft Roham Mehrabi · 2026-10-26 · Trust & Safety Business identity theft is when criminals pose as a real company, its owners or its officers to get credit, open accounts or redirect payments in its name. A common route is the public record: a filing at the business registry that changes the company's address, officers or registered agent, or that reinstates a company that had been dissolved, sometimes alongside a lookalike email domain and website. To spot it, read the company's filing history for changes made just before it contacted you, check whether the new address, officer and domain connect to anything in the company's past, and confirm the request by contacting the company on details you found yourself. This piece covers how a hijack works, why old and dormant companies are targets, the checks a credit, onboarding or accounts payable team can run, and what to do if the company is yours. Our guides to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification) and [shell company red flags](https://www.sixtyfour.ai/blog/shell-company-red-flags) cover company research more widely, and [finding out who owns a website](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website) goes further into domains. #### What is business identity theft? California's Secretary of State [describes it](https://www.sos.ca.gov/business-programs/customer-alerts/alert-business-identity-theft) as criminals who "pose as owners, officers or employees of a business" to get cash, credit and loans, "leaving the victimized business with the debts". Colorado's Secretary of State notes that it is [also known](https://coloradosos.gov/pubs/business/FAQs/secureFiling.html) as "corporate or commercial identity theft". The National Association of Secretaries of State (NASS) describes it in a September 2025 [report on business filing fraud](https://www.nass.org/sites/default/files/reports/final-nass-report-business-filing-fraud-091925.pdf): an unauthorised filing changes a legitimate company's registration details, "e.g. address, officers, registered agent, etc.", and the altered record is used "to obtain loans or lines of credit or to facilitate a variety of other criminal activities". The report says this is "sometimes referred to as 'business identity theft' or 'business hijacking'", and that it can include an unauthorised filing "to reinstate a dissolved (or otherwise inactive) business entity". Colorado's [resource guide](https://coloradosos.gov/pubs/business/ProtectYourBusiness/protectYourBusiness.html) separates two types: "hijacking" an existing business by changing its details, and creating an entirely new business with a victim's address, or sometimes their name and address. This piece is about the first. #### How do criminals hijack a company? A hijack can combine three steps. Change the record. NASS says that in most states the Secretary of State's office "serves only as the official repository for business records", and that a filing which meets the basic requirements may be accepted without the office questioning it or checking what it says. California's list of common schemes includes filing documents "to change the business' registered address or the names of directors, officers or managers of the company". In the UK, Companies House [says](https://www.gov.uk/guidance/protect-your-company-from-corporate-identity-theft) that "Fraudsters are known to hijack a company by changing the details of the company's directors and registered office." Build the front. A [2022 joint advisory](https://www.ic3.gov/CSA/2022/221216.pdf) to the food and agriculture sector from the FBI, the FDA's Office of Criminal Investigations and the US Department of Agriculture lists tactics that include "Creating email accounts and websites that closely mimic those of a legitimate company", using "the names of actual officers or employees of a legitimate business", and "Copying company logos". Use the identity. The same advisory describes falsified credit applications that pass because "The scammer provides the actual information of a legitimate company so the credit check results in an approval of the application." A [2023 FBI announcement](https://www.ic3.gov/PSA/2023/psa230324) on business email compromise (BEC) adds that criminals impersonating real companies "apply and are often granted credit repayment terms known as Net-30 and Net-60 terms, providing fake credit references and fraudulent W-9 forms to vendors." Two federal cases show the pattern. - In Georgia, two brothers were [sentenced in March 2017](https://www.justice.gov/usao-ndga/pr/atlanta-area-brothers-sentenced-corporate-hijacking-scheme), after pleading guilty, for a scheme that ran from 2012 to 2014. According to the Justice Department, they "stole the identities of dormant Georgia corporations" by filing new registration information listing "new company officers and a new corporate address, which was a virtual office space under the conspirators' control." They then used fake credit applications to order laptops and other electronics on credit in the companies' names, over $540,000 of it from 16 suppliers, who "received little more than a couple hundred dollars, if anything". - In New Jersey, federal prosecutors [charged twelve people](https://www.justice.gov/usao-nj/pr/twelve-individuals-charged-11-million-stolen-treasury-check-conspiracy) in November 2025 over a conspiracy to deposit stolen checks. According to the charges, they impersonated the businesses listed as payees "by acquiring business documents in the names of the payees" and used them to open business bank accounts. The [criminal complaint](https://www.justice.gov/usao-nj/media/1419091/dl) alleges that one method was to change the registered agent on a payee's official records to one of the defendants. By October 2026 [ten had pleaded guilty](https://www.justice.gov/usao-nj/pr/two-individuals-plead-roles-11-million-bank-fraud-conspiracy), and charges against the other two, both of whom the complaint says used that method, were still pending. #### Why are established and dormant companies targeted? An established company brings a credit history and a name that suppliers and lenders recognise. Colorado's Secretary of State says criminals "assume a business's identity and good credit history by manipulating business records and credit agency data", then use that identity to get lines of credit with banks or retailers. A dormant company adds a record nobody may be watching. The Texas Secretary of State [warns](https://www.sos.state.tx.us/corp/businessidentitytheft.shtml) that "Criminals target businesses that have been tax forfeited", and the Georgia case above used dormant corporations. The real company often learns late. California says thieves typically "cash out quickly and go unnoticed until the bills and collection notices arrive at the door of the victimized business." How often it happens is unclear. NASS says "the actual scope and prevalence of business filing fraud is difficult to quantify." #### What are the signs of a hijacked company? When a request arrives in an established company's name, check these signals. Each is a reason to look closer, and none proves fraud on its own. - A change of address, officers or registered agent filed shortly before the company contacted you, or a reinstatement after years of inactivity. - A new officer, address or registered agent with no link to the company's past. - An email domain registered recently that differs from the one the company has used for years. - Contact details that differ from the company's archived website, listings and older filings. - A delivery address away from the company's known premises, or pressure to approve credit quickly. The 2022 advisory warns of "last-minute changes" in "shipping destinations" and of "unexplained urgency regarding payment requests or orders, especially from new customers." #### How do you read a company's filing history? Open the full filing history, not just the summary page, and read it in date order. Many registries publish it online: California's bizfile service lets anyone view and print all of a business's filings free, with no log-in, Texas's SOSPortal lets users "review the filing history of an entity", and Companies House's free service includes "full transaction filing" and "current and resigned officers", [according to its guidance](https://www.gov.uk/guidance/searching-the-companies-house-register). Then ask four questions of the filings. 1. When did the details last change? In the Georgia case the record was changed first and the companies' names used afterwards, so a change in the weeks before an application deserves a close look. 2. Who is named now, and who was named before? Compare the latest officers with those in earlier years' filings and with the person who signed your application. 3. Has the registered agent changed? The New Jersey complaint alleges that changing it was one way the defendants took over a company's record. 4. Was the company dissolved, inactive or forfeited, and then restored shortly before it contacted you? Because a registry may accept a filing without checking what it says, a filing shows that someone filed it, which is not the same as showing that the company agreed. Some registries also show little about a company's people, as our guide to [finding out who owns an LLC](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-an-llc) describes, so older filings may be the only place an earlier officer or address appears. #### Does the new address or officer connect to the company's past? A genuine change usually leaves a trail outside the registry, and an impostor's change often has none. For a new address, check whether it appears anywhere else in the company's history: its website over the years, trade directories, invoices you hold, earlier filings. In the Georgia case the new corporate address was a virtual office the fraudsters controlled, and the goods were shipped there. For a new officer, look for anything that ties them to the company before the filing: an earlier filing, a mention on its website, a professional history that names it, news of a sale or a change of leadership. A buyer or new director normally leaves some of these, and the previous officers can often be reached. A name that appears only in the latest filing and on your application needs an answer before you extend credit. #### Is the email domain the company's long-standing one? Compare the domain on the application with the one in the company's older filings, its archived website and any correspondence you already hold. The 2022 advisory says lookalike addresses "may include extra letters or words, substitute characters", such as the number 1 for a lower-case l, "or use a different top level domain". Then date the domain. For a generic domain such as .com, the public registration record includes its creation date, which ICANN's [Lookup tool](https://lookup.icann.org/en) shows through RDAP, [the definitive source](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) of that data since January 2025. A long-established company can move to a new domain, but one created weeks before the application is a reason to ask why. The Internet Archive's [Wayback Machine](https://help.archive.org/help/using-the-wayback-machine/) shows the company's website on each date it was captured, including old contact pages. Gaps prove little, since the Archive notes that some sites are missing because its crawlers "were unaware of their existence at the time of the crawl". A new site at a new domain that copies the old one but changes only the contact details is a strong reason to look further. #### How do you confirm with the real company? Contact the company on details you found yourself, from before the change. The FBI's 2023 announcement advises "Directly calling a business's main phone line to confirm the identity and employment status of the email originator, rather than calling numbers provided via email contact." The 2022 advisory says to "Verify all payment changes, credit requests, and transactions in person or via a known telephone number rather than through a number or link provided in a suspicious email". The source of the number matters, because the hijack may have changed the company's current public record. Take the number from the archived website, older filings, a trade directory or your own records, treat any detail that first appeared with the recent change as unverified, and ask for someone the older records name. In one case in the advisory, a sugar supplier asked to sell a full truckload on credit noticed an extra letter in the email domain and "independently contacted the actual company to verify there was no employee by that name working there". #### What should you do if your company has been hijacked? The first signs often come from outside: bills for credit you never applied for, a supplier asking about an order you never placed, or missing mail. The IRS lists among the [signs of business identity theft](https://www.irs.gov/identity-theft-central/identity-theft-information-for-businesses) that "You don't receive expected or routine correspondence from the IRS because the business address has been changed." Then act quickly. 1. Check your record. Read your filing history at the registry for any filing you did not make. 2. Keep the evidence. California and Texas both advise getting a certified copy of the fraudulent filing before you update your records, so you keep a record of exactly what was filed. 3. Tell the registry and correct the record. Colorado [lets a hijacked business](https://www.coloradosos.gov/pubs/business/ProtectYourBusiness/checklistForVictims.html) file a complaint and correct the details with a Statement of Correction, and California says to submit new filings with the correct information. 4. Turn on the registry's protections. In a NASS survey reported in 2025, 13 of the 20 states that answered offer an email or text alert when a new filing is made on a company's record, and 11 have password protection or other verification for online filing. Under Colorado's [Secure Business Filing](https://coloradosos.gov/pubs/business/FAQs/secureFiling.html), "documents can't be filed without the correct email address and associated password", and California's [User Access](https://www.sos.ca.gov/business-programs/business-entities/statements) lets a business control who can file online on its record. Since 1 August 2026, only users with that access can file a Statement of Information online. 5. Tell your bank, creditors and suppliers. California advises asking whether they have seen "recent or unusual charges or orders" in your name, and California and Texas both advise requesting copies of the documents used to open or access accounts. 6. Report it. California and Texas both advise reporting to local law enforcement, and the 2022 advisory says to "Immediately report any online fraud or BEC activity" to the FBI's [Internet Crime Complaint Center](https://www.ic3.gov/) (IC3). 7. Search for your company's name. The 2022 advisory recommends regular searches to find "multiple websites that may be used in a scam". In the UK, Companies House's [fraud guidance](https://www.gov.uk/guidance/protecting-your-company-from-fraud-and-scams) points to its free Follow service, which emails an alert when a filing on your company is accepted, and its PROOF scheme, which rejects paper versions of forms that change a company's registered office or officers. It warns that anyone who knows your authentication code "can change your company's details online", and directs fraud reports to Report Fraud. A [separate process](https://www.gov.uk/guidance/report-a-company-using-your-personal-details-without-your-permission) covers a company using your name or address without permission, and that guidance points to Police Scotland for a company registered in Scotland. #### A worked example The case is a composite. Calverholt Precision, Ellen Crennock and Dennis Carrowden are invented, the domains use the .example names [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and the phone numbers come from the 555-0100 to 555-0199 range reserved for fictional use. In October 2026 a metals distributor in the Midwest receives a credit application from Calverholt Precision Inc., a machine shop it has never sold to, for 30-day terms on a first order of about $96,000 of aluminium and stainless bar, delivered to an industrial unit in another town. It is signed by Dennis Carrowden as president, comes from d.carrowden@calverholtprecision.example and gives a mobile number, +1 260 555 0186. A business credit report on Calverholt comes back clean, with more than thirty years of history. The filing history. The state registry shows Calverholt incorporated in 1991, with years of periodic reports naming Ellen Crennock as president at the same plant address. Three weeks before the application, a report filed online names Dennis Carrowden as president, moves the principal office to the industrial unit and changes the registered agent. No other filing mentions him. The domain. RDAP shows that calverholtprecision.example was created 19 days before the application. The older filings and every capture of the company's website in the Internet Archive since 2006 use calverholt.example, which RDAP dates to 2002. The new site copies the old one page for page, with the mobile number and the industrial unit in place of the plant. The footprint. A regional manufacturers' association directory, the archived contact page and the older filings agree on the plant address and a main line, +1 260 555 0147, and name Ellen Crennock. Nothing outside the recent filing connects Dennis Carrowden or the industrial unit to the company. The call. The credit manager calls the main line from the directory and the archived site, not the number on the application, and asks for Ellen Crennock. She has not sold the business or moved, does not know Dennis Carrowden and had not seen the filing. Two other suppliers have phoned her in the past week about orders she never placed. The credit report passed because it described the real company. The filing history dated the change, the domain and footprint showed that the new details had no past, and the call settled it. The distributor declines the application, keeps it with the emails and credit report, and files a complaint with the IC3. Ellen Crennock orders a certified copy of the filing, corrects the record, signs up for the registry's email alerts and reports it to her local police. Two questions stay open, and the file says so: who made the filing, and whether Dennis Carrowden is a real person whose name was used or a name invented for it. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Filing history, read in date order | What changed, when, and who was named before | Who submitted each filing, or whether the company agreed | | The new officer's history | Whether anything ties them to the company before the filing | That a person with no public footprint is an impostor | | The new address | Whether it appears in the company's past | Who controls it today | | Email domain and its creation date | Whether the domain is the company's long-standing one, and how old it is | Whether a long-standing mailbox has been compromised | | Archived website and directories | The company's contact details and people from before the change | That those details are still current | | Business credit report | The company's credit history | Whether this application came from the company | | A call on a number from older records | Whether the company made the request | Who did, if it did not | Count only independent evidence: a new website that copies the registry's new address is one fact seen twice. #### What defeats these checks - Patience. A change filed months before it is used removes the timing signal, so the checks on the new officer and address carry more weight. - A compromised mailbox. If the real company's email is taken over, requests come from its long-standing domain. The 2022 advisory lists "Gaining access to a legitimate company's email system" among the tactics, so the call matters even when the domain matches. - Inside access. A former employee, officer or filing agent with the company's registry password or authentication code can file changes that look authorised. Companies House advises changing the code when someone who knows it is no longer authorised to file. - A thin past. A small company may have no website, no directory listing and few filings to compare against. Invoices you already hold and references you found yourself can stand in. - A number from the wrong source. A call to a number taken from the application, or from the company's current record after the change, may reach the impostor. #### Reading the evidence fairly Most changes to a company's record are ordinary, and a fair review checks the ordinary explanation first. - Businesses are sold, owners retire and new directors join. A genuine change of control usually leaves other traces, and the previous owner can often confirm it. - Companies move premises and open new sites. - Rebrands and acquisitions bring new domains, often announced on the old site. - Accountants, registered agents and staff often file on a company's behalf. Colorado suggests adding a registered agent and an accountant as trusted users of a Secure Business Filing account. - In many states a company that misses periodic reports can be dissolved and later reinstated. NASS describes this as part of the ordinary filing process, so a reinstatement means reading the filings around it. - Disputes happen. NASS notes that some changes reported as unauthorised "may be the result of a genuine dispute among parties associated with the entity." Keep three levels apart. A recent change means look further. A recent change with no link to the company's past, alongside new contact details, calls for contacting the company on details you found yourself. The company's answer on those details settles the question, and the file should record what it leaves open. #### Where Sixtyfour fits A registry shows what was filed and when, and the company's own past shows whether the filing belongs to it. Sixtyfour's agent starts from what you already have, such as a company name, an officer's name, an email domain or a website, researches public sources such as registry filings, the company's web footprint, news and professional profiles, links what it finds to the right company and people, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not check bank accounts, credit files or identity documents, and it does not replace the call to the company. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version When a request arrives in an established company's name, read its filing history for recent changes to its address, officers or registered agent, and check whether those details, and the email domain, connect to anything in the company's past. Then confirm the request on contact details you found yourself, from before any change, and if the company is yours, check your record, keep the evidence, correct it with the registry and turn on its alerts. --- ### How to verify a business address *An address on an application is a claim. How to check that it exists, work out what kind of place it is, and tell whether the business really operates there, with what each check proves.* Source: https://www.sixtyfour.ai/blog/how-to-verify-a-business-address Christopher Price · 2026-10-23 · Trust & Safety To verify a business address, establish three things. First, that the address exists and is written correctly, which postal data such as the USPS ZIP Code lookup or Royal Mail's postcode finder can confirm. Second, what kind of place it is: premises the business occupies, a home, a coworking space or virtual office, a mailbox at a mail-receiving store, a registered agent's office, or an empty plot or building site. Third, whether the business actually operates there and whether the address fits its story, which comes from dated street imagery, a search of who else uses the address, the registry's address history, property records and the business's own footprint. This piece explains the addresses a registry holds, takes each check in the order an onboarding, KYB or accounts payable team can run it, and ends with a worked example. Our guide to [shell company red flags](https://www.sixtyfour.ai/blog/shell-company-red-flags) covers registered addresses shared by hundreds of companies, and our [KYB guide](https://www.sixtyfour.ai/blog/kyb-verification) covers the rest of a business check. #### What does verifying a business address involve? An address on an application, an invoice or a website is something the business has told you. Verifying it means answering three questions, each needing different evidence. 1. Does the address exist, and is it written correctly? Postal data answers this. 2. What kind of place is it? Imagery, property records and a search of the address answer this. 3. Does this business operate there, and does the address fit its story? Its own records and footprint, and other people's dealings with it, answer this. A registry record does not settle any of the three on its own, because the business supplies its own addresses. Companies House's [service information](https://resources.companieshouse.gov.uk/serviceInformation.shtml) says that the fact information "has been placed on the public record should not be taken to indicate that Companies House has verified or validated it in any way". A registry tells you what the business said, and when. #### What is the difference between a registered office and a business address? A business can have several addresses on the record, and they mean different things. The registered office, or in the US the registered agent's address, is an address the register publishes for the company. In the US the agent receives legal papers: the instructions to California's [Statement of Information](https://bpd.cdn.sos.ca.gov/llc/forms/llc-12.pdf) for an LLC say that the agent for service of process accepts legal documents on behalf of the LLC. In the UK, the [government's guidance](https://www.gov.uk/limited-company-formation/company-address) on setting up a company says the registered office address "will be publicly available on the online register". The principal office is where the business says it is run from. The same California form asks for the "Street Address of Principal Office", with the instruction "Do not list a P.O. Box", then a separate mailing address that "may be a P.O. Box address or 'in care of' an individual or entity", and then the agent. What a free registry search shows varies. Delaware's [entity search](https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx) gives, free of charge, "the entity name, file number, incorporation/formation date, registered agent name, address, phone number and residency". So the only address the free search shows for a Delaware company is its agent's. A trading address, such as a shop or a warehouse, may appear nowhere on the register, and you find it on the business's website, invoices and packaging instead. So first work out which address you have been given. A registered office tells you where the paperwork goes, and most of the checks below are about the address the business says it operates from. #### How do you check that an address exists? Run it through official postal data, which shows whether the address is in the postal record and gives you the standard form you need for every later search. In the US, the [USPS ZIP Code lookup](https://tools.usps.com/zip-code-lookup.htm?byaddress=) takes a street address, a suite and a city and returns the standardised address with its full ZIP+4. Each result also shows detail fields, including a Commercial Mail Receiving Agency field, fields for a PMB designator and number, and a DPV confirmation indicator. USPS's [address API documentation](https://developers.usps.com/addressesv3) explains the indicator: - Y means the address "was DPV confirmed for both primary and (if present) secondary numbers", though "A value of Y does not necessarily imply that USPS delivers to that address". - S means the street number was confirmed and "the secondary number information was present but not confirmed", so the suite you were given was not confirmed. - D means the street number was confirmed and "the secondary number information was missing". - N means neither confirmed. In the UK, Royal Mail's [postcode finder](https://www.royalmail.com/find-a-postcode) searches by part of an address or a postcode, and carries a caution: "Postcodes are not intended to pinpoint an exact geographical location". A geocoder turns the address into a point on a map. The US Census Bureau's [geocoder](https://www.census.gov/programs-surveys/geography/technical-documentation/complete-technical-documentation/census-geocoder.html) is explicit about its limits: its address ranges "include all possible structure numbers even though actual structures may not exist", and "Coordinate results are interpolated, or approximated". A geocode places an address on a street. It does not show that a building stands there. An address can also exist on paper before anything is built. Royal Mail offers a [Not Yet Built](https://www.poweredbypaf.com/postcode-address-file/not-yet-built/) file of "postcodes and addresses for properties that are under construction or in the planning stage". #### How can you tell what kind of place an address is? Each kind of place leaves its own signs. Premises the business occupies show its name: signage in street imagery, its own listing on a map, photos of staff and stock, and customers who mention visiting. A home shows as a house or a flat in imagery, and the county's property record usually describes a residential property. A mailbox store can show up in the USPS lookup. USPS [defines](https://faq.usps.com/s/article/Commercial-Mail-Receiving-Agency-CMRA) a Commercial Mail Receiving Agency (CMRA) as "a private business that rents Private Mail Boxes (PMBs) to customers and accepts mail from the United States Postal Service for distribution to their customers". Enter a claimed suite number at such an address and the lookup can return the same number as a PMB, with the CMRA field showing Y. A PMB result shows that the address is a mailbox business. It does not show that the box exists or who rents it. A suite that turns into a PMB is a mailbox. A virtual office or coworking space can turn up under the provider's own name when you search the address. Google's [guidelines for business listings](https://support.google.com/business/answer/3038177?hl=en) give a working definition: a business that "rents a physical mailing address but doesn't operate out of that location, also known as a virtual office". For its own listings, Google accepts an office at a co-working space only if it has "clear signage", receives customers during business hours and is staffed by the business's own people. A formation agent's or registered agent's address appears on the filings of many other companies. The UK's Office for National Statistics [notes](https://www.ons.gov.uk/businessindustryandtrade/business/activitysizeandlocation/articles/multiplebusinessregistrationsatasinglepostcodeuk/2023) that providing a registered office address is one of a formation agent's services, and that "In some cases, the formation agent can register thousands of businesses at a single address." Companies House's [advanced search](https://find-and-update.company-information.service.gov.uk/advanced-search) takes a full or partial registered office address and filters by incorporation date. An empty plot or a building site shows as bare ground or construction in recent imagery, and the property record may describe vacant land. USPS's address API, though not the free lookup, also carries a vacancy field, described as whether "the location designated by the address is occupied". #### How do you read street imagery, and how old is it? The date of an image matters as much as the picture. Google's [help page](https://support.google.com/maps/answer/3093484?hl=en) for Street View explains that "You can find street-level imagery taken at different times from the Street View archives and other contributors", through See more dates, and warns that "Historic imagery isn't available for every place that has Street View." Google Earth can show [past versions of a map](https://support.google.com/earth/answer/148094?hl=en) on a timeline. Note the date of every image you rely on, and compare it with the date the business says it moved in. Signage for a different business in a recent image is a question. A shopfront with this business's name, seen in images from several years, is strong evidence that it has been there. Imagery of a tall block tells you little either way, because it cannot see which company holds which floor. #### Who else is at the address? Search the full address in quotes, with and without the suite number, and look for three things. - The provider's own name. A mailbox store or virtual office rents out its address, so a search can return the provider advertising it. - A crowd. Dozens of businesses giving the same street address with different suite numbers is what a mail-receiving business looks like from outside. Hundreds of companies at one registered office points to a formation agent. - This business. Whether its name appears on anything at that address that it did not write itself: a map listing, a review, a supplier's page, a local news story. #### Who owns the building? The property record tells you what kind of building it is and who owns it, which may be a landlord rather than the business. In the US, the county assessor holds the parcel record. Sacramento County lists among its [public records](https://assessor.saccounty.gov/content/assessor/us/en/maps-property-data-and-records/assessor-records.html) the "owner's name (secured only), property address, mailing address", the "zoning code, land use code" and property characteristics. Access varies: Sacramento says that "Due to privacy concerns owner information is not available online", while Maricopa County in Arizona [lets you search](https://www.mcassessor.maricopa.gov/home/help/searching/) by owner name. If the owner is an LLC, our guide to [finding out who owns an LLC](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-an-llc) covers county recorder deeds and following an LLC to the people behind it. In England and Wales, HM Land Registry offers a [free property summary](https://www.gov.uk/search-property-information-land-registry) with "the address held by Royal Mail" and "the property description", and a title register for £7 that usually includes "who owns the property". The kind of property is often the most useful thing the record gives you. A house at an address presented as a warehouse, or vacant land at an address presented as a shop, needs explaining. A commercial building at a mailbox store is what you would expect, and says nothing about the business that rents a box there. #### Does the business actually operate there? Read the registry's address history. Companies House's [filing history](https://github.com/companieshouse/api-enumerations/blob/master/filing_history_descriptions.yml) records each change as "Registered office address changed from" the old address to the new one, with the date, and Companies House offers [free email alerts](https://www.gov.uk/get-information-about-a-company) when a company updates its details, "for example, a change of director or address". In California, an LLC files a Statement of Information within 90 days of registering and every two years after, the form asks for its principal office and mailing address, and [plain copies are available online for free](https://www.sos.ca.gov/business-programs/business-entities/faqs). A business that moved from a house to a mailbox last month, just before applying, has a short history at the address it gave you. Compare every address the business uses. The website's contact page, its invoices, its shipping and returns pages and its packaging can name different places, and the returns address is where goods physically go. A returns address at a warehouse in the same region as the principal office fits an online shop. A returns address in another country, for a business presenting itself as local, does not. Check the phone number. Does it reach the business, does whoever answers know it, and is it the number on the website and the listings? Notice the hours, too: a business that says it runs from California but answers only during another time zone's working day has something to explain. Before any payment, accounts payable teams should call on a number they already hold, which our guide to [verifying a vendor](https://www.sixtyfour.ai/blog/how-to-verify-a-vendor) covers. Look for the business in records other people made over time. Reviews that mention visiting, staff who list the office as their workplace, local news and trade directories place a business somewhere in a way its own website cannot. #### A worked example The case is a composite. Hollinbrae Outdoor and Tess Hessenby are invented, the domain uses the .example name [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and the phone number comes from the 555-0100 to 555-0199 range reserved for fictional use. Hollinbrae Outdoor LLC applies to a payments platform to take card payments for its online shop at hollinbrae.example, which sells camping stoves and lanterns. The application gives a Sacramento street address with Suite 214, the phone number +1 916 555 0172, and its founder, Tess Hessenby. The address. The USPS lookup confirms the street address, returns Suite 214 as PMB 214, and shows the CMRA field as Y. The address is real and belongs to a mail-receiving business, so Suite 214 is a private mailbox there. The place. Street imagery from April 2026 shows a row of shops with a mail and shipping store at that number, as do images from 2022. Searching the address returns the store's own listing and about forty businesses giving the same street address with a suite number. The registry. Hollinbrae filed its articles in California in March 2023. Its Statements of Information from 2023 and 2025 give the principal office as a house in Elk Grove, the mailing address as Suite 214 and a registered corporate agent for service of process. So the business told the state where it is run from, and the application gave its mailing address instead. The home. Sacramento County's parcel information for the Elk Grove address describes a single-family house, which fits a business run from home. The operation. The website's returns page gives a third address, a West Sacramento warehouse run by a fulfilment company whose own website says it stores and ships stock for online shops. Hollinbrae's marketplace reviews go back to mid-2023 and mention orders arriving within two days in California. The phone number reaches Tess Hessenby, who says she runs the business from home, keeps stock at the fulfilment warehouse and uses the mailbox so that her home address is not printed on invoices and parcels. Put together, the address on the application is a mailbox. The business appears to be run from the founder's home, with its stock at a fulfilment warehouse nearby, and three years of reviews fit a small online shop. The team in this case approves the account, records the principal office and the warehouse as the operating locations and the mailbox as the mailing address, and asks for a recent invoice from the fulfilment company. It arrives the next day, showing an account in Hollinbrae's name. Two things stay open, and the file says so. The invoice is the merchant's own document, and the team has not confirmed with the fulfilment company that Hollinbrae is a client. Nothing it found shows how much stock is held there. It schedules a review after the first 90 days of processing. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | USPS lookup or Royal Mail postcode finder | The address exists in postal data, in its standard form, and in the US whether USPS lists it as a mail-receiving business | Who is there, or whether the business operates there | | Geocode | Roughly where the address sits on the street | That a building stands there | | Dated street and satellite imagery | What stood at the address on the date of the image, and whose signage it carried | What is there today, or which company holds a suite inside | | Search of the address | Who else uses it, including a provider's own name | Whether this business is among those really working there | | Registry addresses and their history | What the business told the registry, and when it changed | That any of it is true, since the business supplied it | | Assessor or land record | Who owns the building and what kind of property it is | Who occupies it | | Website, invoices, shipping and returns pages | Where the business says it operates and where its goods go | Anything the business chose not to say | | Reviews, staff profiles, news and directories | Other people placing the business somewhere, over time | That nothing has changed since | | Phone number and hours | That the number reaches the business, at hours that fit its story | Where the person answering is sitting | Count only independent evidence. A website that copies the registry's address is the same claim made twice. #### What defeats these checks - Real but empty premises. A short lease on a small office or a coworking desk with a sign passes the imagery and listing checks. Reviews, staff and customers over time are what show whether anyone works there. - A borrowed address. Someone can give the address of a real warehouse or office that belongs to another business. The imagery and property record then look right, so check that the name on the building is this business's, and call the premises on a number you found yourself. - Gaps in postal data. The Commercial Mail Receiving Agency flag says only whether the address "was found in the CMRA table", in the words of USPS's API documentation. A search of the address that turns up a provider's name answers what a missing flag leaves open. - Old imagery. A business that moved in after the latest images, or one that has left, is invisible to them. Google says it "can't commit to a specific timeline for updates." - A self-written footprint. A website, a listing and a few reviews can all be written by the business itself. Records made by other people, over years, are harder to produce. #### Reading the evidence fairly Most of what makes an address look odd has an ordinary explanation, and a fair review checks it first. - Working from home is common. In 2025, 35 percent of employed people in the US did some or all of their work at home on days they worked, according to the [Bureau of Labor Statistics](https://www.bls.gov/news.release/atus.nr0.htm). - Mailboxes and agents can protect privacy. The UK government's [guidance](https://www.gov.uk/limited-company-formation/company-address) suggests that anyone who does not want their home address on the register use "the address of an accountant or solicitor" or appoint "an agent who will give you an address to use", and California's form reminds an individual agent that their name and street address are "a public record, open to all (as are all the addresses of the LLC provided in filings)". - Formation agents are an ordinary part of starting a company. In the UK, the ONS says "It is common for new businesses to use a formation agent", and an agent's address on the register is often the result. - New businesses are thin. The Census Bureau puts business applications in September 2026 at 534,947, seasonally adjusted, and [projects](https://www.census.gov/econ/bfs/current/index.html) that 29,022 of them will form businesses with a payroll within four quarters. A young business with no staff is ordinary. - Imagery and records lag. An image may be years old, and a filing shows the address on the date it was filed. - Geocodes are approximate. A pin in the wrong place on the street is usually the geocoder, which interpolates along address ranges. Keep three levels apart. A thin record means look further. A contradiction, such as a principal office that is a house when the application describes a warehouse, calls for a question. Two independent records that agree settle what they cover, and the file records what they leave open. #### Where Sixtyfour fits Checking an address by hand means moving between postal tools, imagery, filings, property records and the business's footprint. Sixtyfour's agent starts from what you already have, such as a company name or a website, researches public sources such as registry filings, public records and the web footprint, links what it finds to the right company and people, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version Treat a business address as a claim, and confirm it exists with postal data before anything else. Then work out what kind of place it is from dated imagery, a search of who else uses it and the property record. Finally, check whether the business operates there against its registry history, its own website and shipping addresses, its phone number and the records other people have made about it, and record what stays open. --- ### How to verify a marketplace seller *A seller application is a set of claims about who the seller is and what they sell. How to check each one against evidence the seller did not write, at onboarding and again when the account changes.* Source: https://www.sixtyfour.ai/blog/how-to-verify-a-marketplace-seller Julian Wong · 2026-10-22 · Trust & Safety To verify a marketplace seller, treat the application as a set of claims and check each one against evidence the seller did not write. Confirm that the person or business is real and consistent: the name, contact details and location agree with each other and with the seller's history, and a business appears in the registry where it says it was formed. Then find the seller's track record elsewhere, ask them to prove it is theirs, and check that the stock, prices and volume they want to list fit that history. Check again whenever the account changes, because an account that passed at onboarding can later change hands. This piece takes the checks in the order an onboarding or risk team can run them, with a worked example and a short section for buyers asking whether a seller is legit. Our guides to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) and [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification) go deeper on two of the steps. #### What does a seller application claim? Every seller application makes the same handful of claims, whether or not the form spells them out: who the seller is and where they are, whether they sell as a person or a business, what they sell and where they get it, and where they have sold before. Marketplaces collect some of this directly. eBay's US [seller registration page](https://www.ebay.com/help/selling/getting-paid/registering-seller?id=4792) asks individual sellers for a full name, an address (it does not accept PO boxes) and a date of birth, among other details. A registered business gives its legal name "as it appears on your business registration documents", any trading name, and details for "anyone who is acting on behalf of your business". Other claims arrive as links, to the seller's profiles on other marketplaces, a social shop or their own website. Verification means checking each claim against evidence the seller did not create: a registry record, contact details and profiles that predate the application, reviews other people wrote, and a brand's own list of who sells its goods. The application is where the claims come from, so it cannot also be the evidence for them. #### How common are online shopping scams? The FBI's Internet Crime Complaint Center (IC3) [received 56,478 complaints](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) of non-payment or non-delivery in 2025, with reported losses of about $503 million. The category covers both sides of a sale: goods shipped and never paid for, and payment sent for goods that "are never received, or are of less quality". In the BBB Institute for Marketplace Trust's [2025 Scam Tracker Risk Report](https://bbbmarketplacetrust.org/riskreport/), online purchase scams were the largest category, at 28.4 percent of all scams published on BBB Scam Tracker. Of the people who reported one, 89.3 percent said they lost money, with a median loss of $68, and toys and collectibles were mentioned 1,376 times in reports of online purchase and counterfeit scams. The figures come from reports people chose to submit, so they do not necessarily match how often scams happen. The FTC [reported in April 2026](https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2026/04/reported-losses-scams-social-media-eight-times-higher-2020) that shopping scams were the most reported scam on social media in 2025. Most of the people who lost money after ordering something from an ad said they "paid for things that simply never arrived". On 7 August 2026, announcing a seizure of counterfeit goods at Houston's George Bush Intercontinental Airport, US Customs and Border Protection [said](https://www.cbp.gov/newsroom/local-media-release/houston-cbp-seizes-nearly-4-million-counterfeits-mlb-nike-louis) that "Counterfeit versions of popular brands are regularly sold in online marketplaces and flea markets." #### How do you check who the seller is? Start with consistency. The name, email address, phone number, address and location on the application should agree with each other and with the seller's history, and each should have existed before the application did. ##### Individual sellers For a person selling under their own name, the evidence is mostly the age and spread of their contact details. An email address or phone number that appears in forum posts, old listings or a professional profile from years ago links to a real person more strongly than one created last week, though a US phone number that is given up [eventually gets reassigned](https://recyclednumbers.cs.princeton.edu/assets/recycled-numbers-latest.pdf) to someone else. Our guides to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) and [investigating a phone number](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number) cover how to date each one and where to find it. Check, too, that the city on the application matches where the seller's other accounts say they are. ##### Business sellers A business adds a registry record. Look it up in the registry where it says it was formed. In the US, most secretary of state offices register businesses, and their association, NASS, [links to each state's](https://www.nass.org/business-services/corporate-registration) business registration pages and name databases. Free searches vary: Delaware's [entity search](https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx) returns active and inactive entities alike and says a result "is not an indication of the current status of an entity". In the UK, Companies House lets anyone see [some details for free](https://www.gov.uk/get-information-about-a-company), including a company's registered address, its date of incorporation and its current and resigned officers. Then compare the record with the application: the legal name against any trading name, the formation date against the history the seller describes, and the people named in the filings against the people you are dealing with. A registry entry shows that a business was formed, and whether it trades is a separate question. A recently formed company can belong to an established seller turning a hobby into a business, and then the history should exist under the person's own name and handles. #### Has the seller sold anywhere else? A track record is the strongest evidence a new seller can bring, because other people built most of it over time. Look for it in four places. - Other marketplaces. A seller profile shows when the account joined, what it sells and what buyers said, so read the feedback for the categories and prices the seller wants to sell in. - A social shop. Instagram's [About this account](https://www.facebook.com/help/instagram/697961817256175) panel shows an account's "Date joined" and its "Former username count", the number of times the username has changed, though not the earlier names. - The seller's own website. For a generic domain such as .com, the public registration record includes the date the domain was created, and ICANN's [Lookup tool](https://lookup.icann.org/en) reads it through RDAP, which [became the definitive source](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) of that data in January 2025. Archived copies show what the site said over time, though the Internet Archive [notes](https://help.archive.org/help/using-the-wayback-machine/) that some sites are missing because "the automated crawlers were unaware of their existence at the time of the crawl". - Forums and reviews. A handle with years of confirmed trades in a collectors' forum is hard to fake. The FTC's [advice to shoppers](https://consumer.ftc.gov/articles/online-shopping) works for an onboarding team too: search the name with the words complaint or scam, read reviews from several sources, consider "the reviewer's history", and do not rely on star ratings alone, "because some reviews and ratings are fake or misleading". A history only counts if it belongs to the applicant, so ask them to prove control of each profile they name. One way is to send a short code and ask them to add it to the profile's description, or to message you from the account. #### Do the stock, prices and volume fit the history? Compare what the seller wants to list with what they have sold before. A history of selling used video games does not cover two hundred new consoles. These patterns deserve a closer look: - A new account listing scarce, high-demand items below the going price. The BBB's advice to shoppers warns that "Scammers offer hard-to-find products at great prices". - A sudden move into a new category, especially one that is more valuable, more often counterfeited or harder to source. - A jump in volume, or a steady supply of new retail goods from a seller with no supplier behind them. The last pattern is one way stolen goods reach marketplaces. In a case the Justice Department [described on 29 July 2026](https://www.justice.gov/usao-wdwa/pr/bellevue-man-sentenced-18-months-prison-operating-multi-million-dollar-fencing), a resale business that ran stores on two large online marketplaces bought goods it knew had been stolen from area retailers, mainly over-the-counter medications and health and beauty products, "far below the retail price". In many instances the goods "still had anti-theft devices attached", or stickers marking them for sale only at a particular retailer, and prosecutors wrote that a retailer had complained one of the stores "was not authorized to sell their products". When the stock does not fit, ask where it came from. Ask a seller who buys from a distributor or wholesaler for an invoice, and a collector selling off a collection for a photo of it with their username and the date. #### How do you check an authorised reseller claim? Some sellers claim to be a brand's authorised reseller, official retailer or distributor. Where the brand publishes a list of authorised dealers or a store locator, check the claim against it, using the current copy. Nikon Inc., for example, publishes a dated [list of its authorised US dealers](https://cdn-6.nikon-cdn.com/where-to-buy/nikon_img_auth_dealers.pdf) and notes that it "is subject to change at any time". Where there is no list, ask the brand. A seller missing from the list may still sell genuine goods bought at retail or second hand, so the list tests only the claim of authorisation. A seller who says they are authorised and is not on the brand's own list has made a statement that does not hold, and the rest of the application deserves the same scrutiny. #### Is the seller connected to other accounts? Compare what the new seller shares with accounts already on your platform, especially ones you have closed. Contact details, return addresses, product photos and listing text can all travel between accounts run by the same operator. Two searches cost little. Google's [search by image](https://support.google.com/websearch/answer/1325808?hl=en) can return "Websites with the image or a similar image", which finds photos taken from another seller or a brand. A distinctive sentence from the listing, searched as an exact phrase [inside quotes](https://support.google.com/websearch/answer/2466433?hl=en), finds the same text elsewhere. Check the dates: when two listings share a photo, the older one is more likely to be the source. Our guide to linking related accounts covers how much each shared detail is worth, and why a value shared by thousands of accounts proves little. #### When should you verify a seller again? A verification describes the account on the day it was checked. eBay's registration page says it may need to verify a seller's details "when you register for a seller account, or if you update any relevant information on your account". Changes that justify a fresh look include: - New contact details, especially an email address and phone number changed together, or shortly before a change of payout details. - A new location or shipping origin. - A sudden change of category or volume, or an old, quiet account that wakes up with high-value listings. - A new name or handle, or a profile elsewhere that has been renamed. Social media accounts with a history are bought and sold, which matters when a social shop is part of a seller's track record. In a study presented at the 2025 ACM Internet Measurement Conference, researchers at CISPA and Saarland University [found 38,253 accounts](https://arxiv.org/abs/2412.14985) listed for sale on 11 online marketplaces between February and June 2024, across X, Instagram, Facebook, TikTok and YouTube, at a median price of $157. Such accounts, they wrote, "often come with out-of-the-box public metrics such as followers, likes, and interactions". A takeover looks similar: the history is real, and someone else now controls it. Re-run the checks on whatever changed, and confirm the change through a contact detail you already hold. #### How can a buyer tell if a seller is legit? The buyer's version of these checks is shorter. - Look at how long the seller has been on the marketplace, what they have sold before and what buyers said, and search their name with the words complaint or scam, as the FTC suggests. - Treat a brand-name item at a low price as a question. The FTC warns that "If expensive brand-name items are offered for bargain prices, they could be counterfeit or stolen." - Pay through the marketplace's checkout and, where you can, by credit card. The FTC says never to buy from online sellers "that insist you can only pay with gift cards", wire transfers, payment apps or cryptocurrency. If a purchase goes wrong, tell the marketplace. In the US, [report it to the FTC](https://reportfraud.ftc.gov/) and [file a complaint with the IC3](https://www.ic3.gov/). #### A worked example The case is a composite. Sarrowden Cards and Theo Sarrowden are invented, the domain uses the .example ending [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and the phone number comes from the 555-0100 to 555-0199 range reserved for fictional use. A collectibles marketplace receives a business seller application from Sarrowden Cards LLC. The contact is Theo Sarrowden, at theo@sarrowdencards.example and +1 330 555 0164. The application says Theo has sold trading cards for six years under the handle sarrowdencards on a large general marketplace, and describes the company as an authorised distributor for a card publisher. The first listing is 60 sealed booster boxes of a set released ten days earlier, priced about 25 percent below what the same boxes sell for elsewhere, plus 40 graded single cards. The registry. Sarrowden Cards LLC was formed in its home state seven weeks before the application, and Theo's name is on the formation filing. For a new company, the history should exist under Theo's own name and handle. The contact details. sarrowdencards.example was registered eight weeks ago, which fits the new company. The phone number appears in Theo's trade posts on a collectors' forum going back to 2021, under the same handle. The track record. The sarrowdencards profile joined in 2020 and has about 1,900 feedback ratings, nearly all for single cards under $50, at around 30 sales a month, with no disputes in the past year. The team sends Theo a short code and asks him to add it to the profile's description. He does within the hour, so he controls it today, and the forum posts with the same handle and phone number since 2021 suggest it has been his throughout. The stock. Sixty sealed boxes of a new set is a different business from 30 singles a month. Asked where they came from, Theo says he bought an allocation from a distributor at wholesale, which could explain the price if an invoice shows it. The authorisation. The publisher's own list of authorised distributors does not include Sarrowden Cards. Theo says he buys from a listed distributor and is not one himself, and he changes the wording on his listing. The photos. Most are the publisher's promotional images, which honest sellers use too. One photo of boxes stacked on a desk also appears in a listing from another account on the same marketplace, closed last month after buyers reported orders that never arrived. Theo had posted the photo on the forum a week before that listing went up, so the closed account most likely copied it from him, and it shares nothing else with Sarrowden Cards. The decision. The team approves Sarrowden Cards as a business with a listing cap. The graded singles go live, since they continue Theo's history. Sealed product is capped at ten boxes until Theo sends the distributor's invoice and a photo of the stock with his username and the date written on a sheet of paper. Two questions stay open, and the file says so: where the full allocation came from, until the invoice arrives, and whether the closed account had any connection beyond a copied photo. The team flags the account for another review the first time its contact details, category or volume change. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Registry record | A business with that name was formed, when, and, where the registry lists them, who is named | Whether it trades, or how long the seller has sold | | Contact details and their age | The email address, phone number and location have been linked to this person for some time | That the person controls this account today | | Profiles elsewhere, with proof of control | The applicant runs a selling history that other people built over time | That the history covers this category or volume | | Domain age and archived copies | How long the seller's own site has existed and what it said | Who runs it now | | Stock against history | Whether the listings continue what the seller has sold before | Where the stock came from | | The brand's own list | Whether a claimed authorisation is on the brand's record | Whether goods from a seller not on the list are genuine | | Images and text against other accounts | Whether listing material appears elsewhere, and where it appeared first | Whether two accounts share an operator, on that alone | | A fresh check after a change | Whether the account still matches what was verified | Who is behind a change that looks ordinary | Count only independent evidence: a website and a social profile that both repeat what the application says are the seller's own words seen twice. #### What defeats these checks Each check has a known way around it. - A bought or taken-over history. Proof of control passes, because whoever holds the account now controls it. Look for change around the time it may have changed hands: a rename, a new location, a gap in activity or a new category. - A borrowed identity. Someone can apply with a real person's name and details. Proof of control of the profiles they name, and contact through details that predate the application, are the checks most likely to catch it. - Fake reviews. The FTC warns that some reviews and ratings are fake. Years of feedback from buyers with histories of their own are harder to fake than a burst of five-star ratings. - A slow build. A seller can trade honestly at low volume for months and then list high-value stock it never ships. The onboarding checks pass, which is why a jump in value or volume should start a fresh look. - Copied stock photos. A photo of someone else's stock passes an image search if the original was never posted. A photo with the seller's username and the date in the frame is harder to copy. These checks raise the cost of a fake seller without making one impossible. The ones that hold up best rest on records other people built over time. #### Reading the evidence fairly Most of what makes a seller application look odd has an ordinary explanation, and a fair review checks it first. - Every seller is new once. A first-time seller has no track record, so ask for different evidence: a photo of the stock, receipts for it, and a listing cap that rises with good sales. - Collectors sell their collections, and a large lot of sealed product from someone who has only sold singles can be exactly that. - A seller missing from a brand's authorised list may still sell genuine goods. Only a claim of authorisation fails that check. - Honest sellers use the same promotional photos and the same product descriptions, so a shared image counts only when it is supposed to be the seller's own. - People move and change email addresses and phone numbers, and old numbers are reassigned. A change the seller can explain is ordinary. - Some people keep a thin footprint for privacy, or sell mostly in person at shows. So keep three levels apart. Thin means look further. A contradiction, such as a profile the applicant cannot control or an authorisation the brand does not list, calls for an explanation. A current record you found yourself, such as the brand's own list, carries the most weight. Ask the seller about anything that does not fit before deciding. #### Where Sixtyfour fits Checking a seller's history by hand means working through other marketplaces, social profiles, forums and registry filings, and noting the source of every finding. Sixtyfour's agent starts from what the seller gave you, such as a name, an email address, a phone number, a username or a business name, researches public sources, and links what it finds to the right person or business. Every finding comes with its source, and anything it could not establish is reported as open. A person on your team decides. It does not check bank accounts or payout details. There is more on how platform teams use it on our [trust and safety page](https://www.sixtyfour.ai/solutions/trust-and-safety). #### The short version Treat a seller application as a set of claims and check each one against evidence the seller did not write: the registry for a business, the age of the contact details, a track record the seller can prove is theirs, stock that fits that history and the brand's own list for any authorisation. Check again whenever the account changes. --- ### What is identity resolution, and how does it work? *Deciding whether separate records belong to the same person is an old statistical problem. How the method works, what each identifier is evidence of, the two errors that matter, and how to write a match down so someone else can check it.* Source: https://www.sixtyfour.ai/blog/what-is-identity-resolution Saarth Shah · 2026-10-21 · Trust & Safety Identity resolution is the work of deciding whether separate records refer to the same real person or organisation, linking the ones that do, and keeping the evidence behind each decision. It compares the identifiers the records carry, such as names, dates of birth, addresses, email addresses, phone numbers, usernames and photos, and weighs each agreement by how rare the value is and whether it is independent of the others. Each pair of records ends up as a match, a non-match, or a possible match that a person reviews. This piece covers where the method comes from, how it works, what each identifier is evidence of, and how to record a match so someone else can check it. Our guides to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) and [running an OSINT investigation](https://www.sixtyfour.ai/blog/how-to-run-an-osint-investigation) apply the same ideas to a platform's own data and to open sources. #### Where does identity resolution come from? Identity resolution grew out of record linkage, the work of assembling the records that belong to one person. A [2022 review](https://arxiv.org/abs/2008.04443) by the Duke University statisticians Olivier Binette and Rebecca Steorts dates the first known paper on it to H. L. Dunn in 1946, who proposed binding each person's records together with the birth certificate number. For records with no such identifier, the review credits H. B. Newcombe and colleagues with the first automatic, computer-based method: their 1959 paper described linking 34,138 birth records from British Columbia to 114,471 marriage records. In the review's words, "No single piece of information was entirely reliable, but together they could be used for more accurate record linkage." In 1969, Ivan Fellegi and Alan Sunter gave the idea a formal mathematical model in their paper [A Theory for Record Linkage](https://www.irs.gov/pub/irs-soi/1985preprintar28.pdf). As a [US Census Bureau research report](https://www.census.gov/content/dam/Census/library/working-papers/2006/adrm/rrs2006-02.pdf) describes it, each pair of records gets a matching weight, comparing how likely its pattern of agreements and disagreements is among true matches with how likely it is among non-matches. Two thresholds then sort every pair into matches above the upper one, non-matches below the lower one, and possible matches in between, which the report says to "hold for clerical review" by a person. The thresholds come from the error rates the user will accept for false matches and false non-matches. #### How does identity resolution work? The steps are the same whether a person works by hand or software works across millions of records. 1. Standardise the records. Split names into parts, expand abbreviations, and write dates, phone numbers and addresses in one format. Normalise email addresses only where the provider does: Gmail [delivers mail](https://support.google.com/mail/answer/7436150) sent to any dotted version of a Gmail address to one inbox, but for Gmail used through work or school, "dots do change your address". 2. Decide which pairs to compare. Comparing every record with every other is rarely practical, so linkage compares pairs that share something, such as a surname or a date of birth, a step called blocking. The Duke review notes that blocking this way amounts to "a deterministic a priori judgment that these fields are error-free". A search on one spelling of a name does the same by hand: anyone recorded under another spelling never reaches the comparison. 3. Compare each field, allowing for near agreement. In a major census application described in the Census Bureau report, more than 25 percent of matches would not have been found by exact, character-by-character comparison. 4. Weigh each agreement by how rare the value is. In the Duke review's example, two records agreeing on the less common first name Xander are more likely to match than two agreeing only on John. Rarity is local too: the Census Bureau report notes that a surname such as Martinez is relatively rare in Minneapolis and more frequent in Los Angeles. 5. Decide: match, non-match, or possible match for a person to review, and write down why. #### Deterministic vs probabilistic matching Deterministic matching links records by fixed rules. The simplest is exact matching, in which, as the Duke review puts it, "two record pairs are linked if they agree on all common attributes". The review notes that "the most commonly used record linkage methods are based on a series of deterministic rules", valued for being simple and easy to interpret. Probabilistic matching weighs each agreement and disagreement and adds them up, as in the Fellegi and Sunter model, so strong evidence on several fields can outweigh a typo on one. The review cites studies in epidemiological research that "have shown consistent improvements of probabilistic methods over deterministic approaches". The two combine well: fixed rules for exclusions, such as two clearly different dates of birth, and weighing for the rest. #### Identity resolution, entity resolution and record linkage The terms overlap. The Census Bureau report lists entity resolution, object identification and fuzzy matching among the other names for record linkage, and notes that "An entity might be a business, a person, or some other type of unit". In this guide, and in the investigations work we do, identity resolution means the same task applied to people and organisations, where the question is who is behind a record. Marketing uses the term differently. IAB Tech Lab, a non-profit standards consortium for digital advertising, [describes](https://iabtechlab.com/wp-content/uploads/2024/05/Identity-Solutions-Guidance-FINAL.pdf) an identity resolution service as one that matches multiple identifiers to provide "a unified view of an entity", using match keys such as hashed email addresses, hashed phone numbers, and names with postal addresses. That version links what advertisers and publishers know about each customer or prospect, while the investigator's version starts from one identifier and researches public sources to work out who is behind it. #### How strong is each identifier? Each identifier is evidence of something narrower than identity. Ask what an agreement shows, and how often it would happen between two different people. A name on its own is weak evidence. In its [2020 Census name data](https://www.census.gov/topics/population/genealogy/data/2020_names.html), the Census Bureau counted 2,369,644 people with the last name Smith and 3,476,721 with the first name Michael, and found that just [69 first names](https://www2.census.gov/library/publications/decennial/2020/c2020br-13.pdf) covered a quarter of the population, as did [258 last names](https://www2.census.gov/library/publications/decennial/2020/c2020br-14.pdf). The bureau publishes no counts of full names, but those figures show how quickly a common one collides. One person's name also varies: the Census Bureau report treats Bill and William as a difference that appears between true matches, and the Wolfsberg Group, an association of banks, gives Piotr Czajkowski, Pyotr Tchaikovsky and Piotr Chaykovskiy in its [guidance on news screening](https://wolfsberg-group.org/resources/168/118) as transcriptions of one name. A date of birth narrows the field without settling it. The CDC's [provisional count](https://www.cdc.gov/nchs/data/vsrr/vsrr043.pdf) of US births in 2025 was 3,606,400, about 9,900 on an average day, so a matching date fits thousands of people. It works better as an exclusion. The Wolfsberg guidance lists differences in "key secondary identifier information", such as a date of birth, or a date of incorporation for a company, among the measures that may justify discounting a news alert as a false match, and treats profession and residence as "weaker" grounds. An address shows that two records were connected to one place when each was written. People move: the Census Bureau's American Community Survey [found](https://www.census.gov/topics/population/migration/guidance/acs-1yr.html) that 11.8 percent of people had moved to a different residence in 2024. Households share addresses too, and the Census Bureau report gives the case of a husband and wife, two different people whose records can agree on "last name, age, house number, street name, telephone". A personal email address is among the stronger identifiers, because one inbox usually belongs to one person and some providers never reissue an address: Google says a removed Gmail address ["can't be used by anyone in the future."](https://support.google.com/accounts/answer/61177) Families and small businesses share inboxes, though, and a work address belongs to the job as much as to the person. A phone number is strong evidence when both records used it at about the same time. The Federal Communications Commission estimated in 2018 that approximately 35 million US numbers are disconnected and made available for reassignment each year, and Princeton researchers who [studied number recycling](https://blog.citp.princeton.edu/2021/05/03/phone-number-recycling-creates-serious-security-and-privacy-risks-to-millions-of-people/) note that "after a while, carriers reassign them to new subscribers." A number that verified one account in 2019 and another in 2026 may belong to two people, so treat the dates as part of the identifier. A username is evidence in proportion to how unusual it is. In a 2011 study of usernames across online services, [researchers at INRIA](https://arxiv.org/abs/1101.5578) found that the chance two identical usernames belong to the same person depends strongly on how unlikely anyone else is to choose that string. In their data, 70 percent of usernames contained part of the person's real name, so a username agreement often repeats a name agreement, and most people used two or three different usernames, so a missing match proves little. A photo shows that the same image appears in two places, which links whoever uploaded it. It does not link the person pictured, because images are copied: the FBI has [warned](https://www.ic3.gov/PSA/2024/PSA240903) of impersonators using "pictures stolen from open social media profiles of the impersonated individual." Treat resemblance between different photos as support for a match that rests on other evidence. #### Why does independent agreement count for more? A common way to overstate a match is to count one fact several times. The Fellegi and Sunter weights add up the evidence field by field, assuming that agreement on one field says nothing about agreement on another once you know whether the pair truly matches. The Census Bureau report shows what goes wrong when that fails: agreement on a surname's phonetic code adds nothing once the surnames agree, and counting it anyway "erroneously increases the total agreement weight". In an investigation, the same problem appears whenever several details come from one source. A profile's name, city and employer were typed by one person, so a second profile that copied them agrees three times on one claim. A registry filing and a reporter's news story are usually two sources, and agreement between them counts twice unless one was copied from the other. Agreement counts once per source, however many fields it fills. For each agreement, ask whether it would still hold if the others turned out to be a coincidence or a copy. Records that agree too neatly deserve the same question, since a synthetic identity is built so that every piece of it checks out, as our guide to [detecting synthetic identity fraud](https://www.sixtyfour.ai/blog/how-to-detect-synthetic-identity-fraud) explains. #### Which conflicts should block a match? A conflict is a disagreement that two records about one person should not show. Many differences are ordinary: a nickname, a typo, a transliteration, an old address, a married name. Others are hard to explain if the records describe one person, such as dates of birth years apart, different middle names written out in full, or activity recorded after a death. Generational suffixes need care, because a father and son can share a name and some datasets drop suffixes. The Duke review shows two records of deaths in El Salvador that could describe one person, "but they could also be father and son". Decide before you start which conflicts block a match and which only lower its weight. A hard conflict holds the pair as a non-match until something explains it, and a soft one goes in the record with the explanation you accepted. Our guide to [adverse media screening](https://www.sixtyfour.ai/blog/adverse-media-screening) applies the same thinking to whether a news story is about your person or a namesake. #### The two errors: a false merge and a missed link A matching decision can go wrong in two ways. A false merge links records that belong to different people. A missed link leaves apart records that belong to one person. The Duke review describes Fellegi and Sunter's two error rates as the probability "of linking when the records do not match" and the probability "of not linking when the records do match", and moving the thresholds trades one against the other. Which error costs more depends on the use. A duplicate in a mailing list costs a second letter. A false merge in a fraud case attaches one person's history to someone who did nothing, and a missed link lets a banned operator return under a new account. Set the bar for a match from that cost, before you look at the records. Our public benchmark of researching individuals, [RECON](https://www.sixtyfour.ai/recon-benchmark), is built around the same asymmetry. Agents start from a name and a few identifying details and must recover facts "without confusing people who share a name". A correct answer earns one point, a wrong answer loses one, and a missing answer earns zero, so a confident answer about the wrong person scores below an honest gap. #### Why chaining links needs care Matches are often treated as transitive. As the Duke review puts it, "In many cases, knowledge that records A and B are a match, and that B and C are a match, means that necessarily A and C are also a match." That holds when both links are right. When one is wrong, the chain joins two people who share nothing directly. Researchers at the University of Connecticut who [studied the clustering of linked records](https://journals.plos.org/plosone/article?id=10.1371%2Fjournal.pone.0154446) call this the chaining problem: when records are grouped whenever any two are similar enough, A and C can land in one cluster even though they are too different to match on their own. In their tests on 1,000,000 synthetic records of 100,000 people, methods prone to chaining failed to group all the records correctly for 1,981 people, against 241 for the method they designed to avoid it. In an investigation, a chain often runs through a value that belongs to more than one person, such as a business inbox, a family phone or a brand's account. Before merging the ends of a chain, compare those two records directly and look for conflicts, and be wary of a cluster that keeps growing through one shared value. #### How do you document a match? Write each decision down so that someone who was not there can check it, or undo it. For every pair you link or decline to link, record: - The two records, where each came from, and when. - Each identifier compared, with its value in each record and after standardising. - How common each agreeing value is, and how you know. - When each record used the value, for anything that changes hands, such as a phone number. - Which agreements depend on others, so that each counts once. - Every conflict, with the explanation you accepted or the reason it blocked the match. - The decision, who made it and when, and what evidence would change it. If an identifier was missing from one record, say it was not compared, so that nobody later reads silence as agreement. #### A worked example The case is a composite. Quellmore Ceramics and the people in it are invented, its domain uses the .example names [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and its phone number comes from the 555-0100 to 555-0199 range reserved for fictional use. Before releasing a first large payout to a new ceramics seller, a marketplace's trust and safety team wants to confirm that the person named in the seller's payout details is the person running the shop. It has three records, two of them its own. - The seller account, opened in March 2026: display name M. Teague, store name Quellmore Ceramics, contact email hello@quellmore.example, verified phone number +1 503 555 0147, shipping from Portland, Oregon. - The payout details entered during the marketplace's own seller onboarding: holder name Marisol A. Teague, born in 1991, a Portland address, and the same phone number, verified the same week. - The public social profile @quellmoreceramics: posting since 2021, a profile photo of a woman at a potter's wheel, a link to quellmore.example, and posts signed Dana. The seller account and the payout details. The phone number was verified separately on each within days, which shows control of the same number at the same time. The names are compatible, and the city agrees, but the name could not carry a match alone: the 2020 Census counted 23,089 people with the last name Teague and 49,544 with the first name Marisol. With a strong, recent shared identifier and no conflict, the team links the two as one person. The seller account and the social profile. The store and the profile link to each other and the handle repeats the store's name, but whoever runs the brand wrote all of that, so it counts as one fact: the profile belongs to the business. Looking for something written by someone else, the team finds a 2023 local newspaper feature about the studio. It names the two founders, Marisol Teague and Dana Quarrington, and runs the profile's photo with a caption naming the woman at the wheel as Dana. The conflict. Chaining the two links would attach the profile and its photo to Marisol, but the posts are signed Dana and the caption names the woman in the photo as Dana. The team links the profile to Quellmore Ceramics and to Dana, and keeps it off Marisol's record. Only the payout details carry a date of birth, so the file says it was not compared. The decision. The seller account and the payout details belong to Marisol A. Teague: the shared phone links them, and the seller's display name, M. Teague, points to her rather than to her co-founder. The payout goes ahead. The file records each link with its evidence, and two questions stay open: whether Dana has access to the seller account, and who answers hello@quellmore.example. #### What each identifier proves | Identifier | What a strong agreement shows | What it cannot show | | --- | --- | --- | | Full name | The records may describe one person, more so when the name is rare | That they do, when thousands share the name | | Date of birth | Consistency with one person, and a clear difference is strong evidence against a match | Identity on its own, with about 9,900 US births a day in 2025 | | Address | A connection to the same place when each record was written | Which person in a household, or that they still live there | | Personal email address | One inbox received mail for both records | Who reads a shared inbox | | Phone number, used close in time | Control of the same number at the same moment | The same person years apart, because numbers are reassigned | | Distinctive username | Probably the same person, more so the more unusual the handle | Much, when the handle is common or built from the name | | The same photo | The same image was uploaded in both places | That the person pictured runs either account | | Several fields from one source | One claim, made once | Independent confirmation | #### What defeats these checks Each check has a known way around it. - Copied identifiers. An impersonator who uses a real person's name and photo makes the records agree on purpose, and the matches then point at the victim. The dates on each record often expose it. - Manufactured agreement. A synthetic identity agrees with itself because its maker kept it consistent. - Shared values. A household, a small business or a shared inbox makes several people look like one, and a chain through the shared value merges them. - Deliberate separation. A person who uses a different name, email address and handle on every service leaves nothing for an agreement to find, which produces missed links. - Reassignment. A recycled phone number or a reused handle connects a new owner to an old owner's records. - Copied errors. A wrong date or address copied from one database into several looks like corroboration. Trace each agreement back to where it was first recorded. #### Reading the evidence fairly Most disagreements between records about one person have ordinary causes, and a fair review checks those first. - People change their names and move house, and names are spelled differently across scripts and languages. Check the dates before treating two names or addresses as a conflict. - Records are typed by people. In one region in the Census Bureau report, 25 percent of first names and 15 percent of last names did not agree character by character among pairs that were true matches. - Datasets alter names. The Census Bureau's processing of 2020 Census names counts SMITHJR and SMITH III as SMITH, and found that PEÑA had been converted to PE?A, which the bureau corrected to PENA. - A missing value is not a conflict. If one record has no date of birth, the match neither gains nor loses from it. - Families, flatmates and business partners share phones, addresses and inboxes, so a shared value there shows a connection and leaves open which person a record belongs to. - When the person is a customer or an applicant, asking them about a difference is often the quickest way to settle it. #### Where Sixtyfour fits Resolving an identity by hand means searching each identifier across registries, news, professional profiles and the web, and tracking which finding belongs to whom. Sixtyfour's agent starts from an identifier you already have, such as a name, an email address, a phone number, a username or a company, researches public sources, and links what it finds to the right person or company. Every finding comes with its source, and anything it could not establish is reported as open. A person on your team makes the decision. There is more on how investigators use it on our [investigations page](https://www.sixtyfour.ai/solutions/investigations). #### The short version Identity resolution decides whether separate records belong to the same person by weighing each agreement on how rare it is and whether it is independent of the others, treating clear conflicts as blocks and holding uncertain pairs for a person to review. Check chains link by link, set the bar for a match from the cost of each kind of error, and write every decision down with its evidence so someone else can check it. --- ### How to tell if a job reference is fake *The candidate chooses the referee and supplies the contact details. How to check that a referee is real, reach them through a channel you found yourself, and read what an email address and a phone number say.* Source: https://www.sixtyfour.ai/blog/how-to-tell-if-a-reference-is-fake Hashim Khawaja · 2026-10-20 · Trust & Safety To tell if a job reference is fake, check the referee without relying on the contact details the candidate gave you. The candidate chooses the referee and supplies their name, email address and phone number, so a check that uses only those details can reach the candidate's friend, or the candidate. Confirm that the referee exists and worked where the candidate says, reach them through the company's main number or another channel you found yourself, and read the email domain and phone number for whom they belong to. Then compare the referee's account of the job with the candidate's, and look for patterns across the references. This guide takes those checks in turn, with what each one proves and a worked example. For the candidate's own claims, see our guide to [verifying a resume](https://www.sixtyfour.ai/blog/how-to-verify-a-resume), and for the organised schemes behind many fake applications, our guide to [spotting fake candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates). #### Why can a reference check reach the wrong person? A reference check usually starts from details the candidate supplied: a name, a job title, an email address and a phone number. Each of them can be chosen to make the check succeed. Timothy Bednall, an associate professor of management at Swinburne University of Technology, [writes](https://theconversation.com/will-checking-character-references-really-help-you-find-the-best-candidate-for-a-job-227360) that reference checks are "a relatively easy hurdle for candidates to overcome because referees are typically self-selected". Documented cases show how little it takes. In a [2022 investigation summary](https://www.canada.ca/en/public-service-commission/services/oversight-activities/investigations/summaries-investigation/summaries-investigation-fraud/false-information-candidate-employment-status/false-information-employment-references.html), the Public Service Commission of Canada described a candidate who was asked for references from a current and a previous manager. Both completed questionnaires came back from what seemed to be personal email accounts, and the candidate's name "was also linked to the email account of one referee." Asked for work addresses, the candidate supplied one and offered a third referee in place of the other. The candidate later "admitted that they had created 2 email addresses to impersonate and act as their own references." New Zealand's Serious Fraud Office [describes a case](https://www.sfo.govt.nz/counter-fraud/case-studies/husband-and-wife-work-together-to-defraud-oranga-tamariki-of-over-2-million) in which a woman was hired in 2021 as a property and facilities manager at Oranga Tamariki, a government agency, using references that "were not written by the claimed authors." She assigned work to her husband's company, and Oranga Tamariki made payments on its invoices totalling just over NZ$2.1 million. After resigning, she used another forged reference to get a job at Waka Kotahi NZ Transport Agency, and she was later sentenced to three years' imprisonment. The first red flag the SFO lists is that she "provided forged references from personal rather than business accounts." Some fake references are bought. People Management, the HR magazine, [reported in February 2026](https://www.peoplemanagement.co.uk/article/1947611/increase-falsified-employment-history-causing-hr-headaches) that commercial "reference houses" offer paid-for references and employment verification, and "even company email addresses and websites to support people's applications." So a number on a reference sheet may ring a friend or the candidate, and a company domain may have been registered for the occasion. A reference check is only as independent as the contact details it uses. #### How does remote and contract hiring change the risk? Contract and remote hiring put distance between you and the employers a candidate names. The FBI [warned in July 2025](https://www.ic3.gov/PSA/2025/PSA250723-4) that people helping North Korean IT workers get jobs had set up US-based front businesses, "including businesses purporting to offer short-term technical contract workers", and that contract IT work "is a common way that North Korean IT workers procure employment." Front companies can pass for employers. In April 2026, two US nationals were [sentenced](https://www.justice.gov/opa/pr/two-us-nationals-sentenced-facilitating-fraudulent-remote-information-technology-worker) to 108 and 92 months in prison for their part in one such scheme. According to the Justice Department, they created shell companies with corresponding financial accounts "to make it appear as though the overseas IT workers were affiliated with legitimate U.S. businesses", and those companies "had no employees or operations." The FBI had seized four web domains associated with them. The FBI's [January 2025 warning](https://www.ic3.gov/PSA/2025/PSA250123) points at the contact details. It says North Korean IT workers "have reused phone numbers (particularly voice-over-IP numbers) and email addresses" on resumes for different applicants, and advises employers to "Cross-check HR systems for other applicants with the same resume content and/or contact information." The same cross-check works for referees. #### Does the referee exist, and did they work there? Start with the person, using sources the candidate did not write. New Zealand's Serious Fraud Office, in its [pre-employment screening guidance](https://www.sfo.govt.nz/counter-fraud/guidance/pre-employment-screening), advises employers to "Double-check the referee's name, job title and contact information against sources such as LinkedIn or the organisation's website." The UK's National Protective Security Authority (NPSA), the government's technical authority for personnel security, says in its [employment screening guide](https://web.archive.org/web/20260315204938/https://www.npsa.gov.uk/system/files/documents/npsa-employment-screening-a-good-practice-guide.pdf) that you "should confirm the existence of the employer (e.g. that it appears in relevant business directories)". In practice, look for: - The referee on the company's own website: a team page, a press release, a talk given on the company's behalf. Archived copies of those pages can show who was there in a given year, as our guide to [verifying a resume](https://www.sixtyfour.ai/blog/how-to-verify-a-resume) explains. - The company in a registry. In the UK, Companies House [gives free details](https://www.gov.uk/get-information-about-a-company) of companies on its register, including the date of incorporation and current and resigned officers, which helps at small firms where the referee may be a director. In the US, companies register with a state, and the National Association of Secretaries of State [links to each state's](https://www.nass.org/business-services/corporate-registration) business registration pages. - A footprint other people wrote over several years: customers, news, trade bodies and job adverts. A company that exists only on its own website has not shown that it trades. - The referee's own professional history, checked for dates that overlap the candidate's. A manager who joined after the candidate left cannot have managed them. A company newer than the job it vouches for is the clearest mismatch. A firm incorporated in 2025 that vouches for work in 2022 may have a predecessor company or an old name, so ask. Small firms also leave thin records for ordinary reasons, covered below. #### How do you contact a referee independently? Reach the referee through the organisation, on a number you found yourself. The NPSA guide advises contacting the employer "to confirm that they have provided the reference, and discuss its contents", and adds: "Telephone numbers supplied by the applicant should not be wholly relied upon." 1. Find the company's main number on its own website, in a directory or in its filings, and never in the reference or the candidate's application. 2. Call it and ask for the referee by name, or for their team. A switchboard that puts you through shows the person works there. One that has never heard of them is a strong finding, worth confirming with HR. 3. If the company sends reference requests to HR, ask HR to confirm the candidate's dates and title, and whether the referee worked there and in what role. 4. If the referee has moved on, find them at their current employer the same way, and ask the former employer's HR to confirm that they worked there. Prefer a conversation to a form or a letter. The SFO advises employers to "Be cautious of candidates who only provide written references or referees who are not able to be contacted for a live conversation." A written reference is easy to produce in someone else's name, and a call through a switchboard is much harder to fake. #### What does the referee's email address tell you? Read the domain first. A manager at a company of any size usually writes from the company's domain, and the SFO says that written references "from personal or free email accounts such as Gmail or Hotmail, rather than business email addresses, can be a warning sign that the referee is not who they claim to be." Treat a personal address as a reason to check, since a referee who has left an employer has no work address to use. A company domain still needs reading. Compare it with the domain of the company's own website, character by character. The FBI and two other federal agencies [have described](https://www.ic3.gov/CSA/2022/221216.pdf) fraudsters creating "email accounts and websites that closely mimic those of a legitimate company", with addresses that "may include extra letters or words, substitute characters" or use a different top-level domain. A reference from examplecorp-hr.example, when the company's website is at examplecorp.example, is the pattern to catch. Then date the domain. For a generic domain such as .com, the public registration record includes the date the domain was created. ICANN's [Lookup tool](https://lookup.icann.org/en) reads that record through RDAP, which [replaced WHOIS](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) as the definitive source of the data in January 2025. A company that says it employed the candidate for three years, writing from a domain registered last month, needs to explain the change. Check too whether the domain hosts a working website that agrees with the company's other records. Last, search the address itself. In the Canadian case, the candidate's own name was linked to one referee's email account, and an address that turns up under the candidate's name is one of the strongest findings a reference check can make. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) covers what one address can show. #### Who does the referee's phone number belong to? Work out whose number it is before you dial it. Compare it with the numbers the company publishes on its website and in directory listings. A mobile or an internet phone number given as a direct line at a large employer deserves a question. A current-carrier lookup usually shows the line type and the carrier serving the number today. Our guide to [investigating a phone number](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number) explains what that can and cannot tell you, including why a number's older records may belong to an earlier holder. Internet phone lines are common at small businesses, so a line type is a reason to look further and nothing more. Then search for the number. A referee's number that appears on the candidate's own CV, among another referee's details or in an earlier application to your platform ties the reference back to the candidate. #### Does the referee's account match the candidate's? A real referee knows things the candidate did not tell you. Ask open questions and let the referee supply the facts: the candidate's title, the dates they worked together, who the candidate reported to and what they worked on. Compare the answers with the CV after the call. The SFO notes that reference checks can confirm employment and the "structure of the role and responsibilities, reporting lines and tenure." Ask every referee the same questions. Bednall writes that "Research suggests using a standardised set of questions can produce more reliable outcomes", and the same questions make the answers easier to compare. In the Canadian case, the questionnaires returned from the same referee's personal and work email addresses "had significant differences, such as their evaluation of the candidate's work and the time they had supervised the candidate." Small differences are normal, since people forget dates and round titles up. A referee who cannot describe the work, or agrees with everything you read out, has told you very little. #### What patterns show up across several references? Read the references together as well as one by one. The SFO advises comparing written references "to identify where there might be similar sentence structures or grammatical errors", because similarities in writing style "may indicate that the same person is the author of multiple references." Other shared patterns are worth recording: - The same email domain for referees at different companies, or domains registered within a few weeks of each other. - Phone numbers on the same internet phone provider, or numbers that run close together in sequence. - Referees whose public profiles tie them more closely to the candidate than to the employer they speak for, such as the same course and graduation year and no record at the company. Then notice how the candidate responds when you ask for a referee you can reach through an employer's main number. That is a fair request, and a candidate with real references can usually meet it. A candidate who offers a different referee instead, as in the Canadian case, has left the question open. As the SFO puts it, "It may be possible to identify someone impersonating a referee when referee information is obtained from several sources." #### A worked example The case is a composite. The candidate and the companies are invented, the domains use the .example names [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and the phone numbers come from the 555-0100 to 555-0199 range reserved for fictional use. A talent marketplace places contract data engineers with enterprise clients. Linnea Corwath applies for a six-month contract. Her profile lists three roles: data engineer at Velsmere Freight, a logistics company, from 2019 to 2022, senior data engineer at Brackwold Insurance from 2022 to 2025, and a contract at Pennacott Analytics, a consultancy, since 2025. She gives one referee for each role. Warm written references from the Brackwold and Pennacott referees arrive within an hour of the requests. The Velsmere manager asks to talk by phone. Velsmere. The company's website, its registry record and years of trade press agree. The vetting lead calls the main number from Velsmere's website, +1 312 555 0100, and asks for the manager by name. The switchboard puts her through, and she gives Linnea's title and dates within a month of the CV, describes the pipelines Linnea built and names the team's director at the time, who appears on an archived team page. The direct line Linnea supplied, +1 312 555 0164, is the one Velsmere's website lists for its data team. This reference holds up. Brackwold. The referee's address is a free webmail account, and the number is a mobile. Brackwold's switchboard routes reference requests to HR, which confirms that Linnea worked there as a senior data engineer from 2022 to 2025 and, by policy, nothing more. HR has no record of anyone with the referee's name. A search of the webmail address finds a public profile under that name listing the same university course and graduation year as Linnea, and no job at Brackwold. Asked for a contact the team can reach through Brackwold itself, Linnea offers a different referee, from another job, with another webmail address. Pennacott. An RDAP lookup shows that pennacott-analytics.example was created 23 days before Linnea applied, for a contract she says began in 2025. The website is one page naming only the director, and the registry of the state it names has no entity by that name. The office number, +1 312 555 0188, is an internet phone line, and the same number appears on an application Linnea made to the marketplace two years earlier, listed as her own. The two written references share two identical sentences. Put together, one reference stands up, and two lead back into Linnea's own circle: a university contemporary with no record at the employer, and a consultancy whose phone number Linnea once listed as her own and whose domain is younger than the contract it vouches for. A number can pass to a new holder, so the team does not treat the shared number as proof on its own. It records what it confirmed, sets out the findings for Linnea, and asks her to explain the number and to name a referee reachable through Brackwold. Three questions stay open, and the file says so: whether the Pennacott contract happened at all, who wrote the two written references, and how well Linnea performed at Brackwold, since HR confirmed only her dates and title. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | The referee on the company's website, filings or archived pages | A person with that name and role was there | That the person you are emailing is them | | A call through the company's main number | The referee works there and answers to that name | That they will give a candid account | | HR confirmation | The candidate's dates and title, and whether the referee worked there | How well the candidate did the job | | An email address on the company's domain | The sender controls a mailbox on that domain | That the domain is the company's own | | The domain's creation date | How long the domain has existed | Who registered it | | A number the company publishes | The number reaches the company | That the person who answers is the referee | | The referee's unprompted account matches the CV | The referee knows the role first-hand | That the account is honest | | No shared pattern across references | The references look independent of each other | That each referee is independent of the candidate | Count only independent evidence: a referee's profile and a company website that the candidate controls can be one source seen twice. #### What defeats these checks Each check has a known way around it. - A real friend at a real company. The referee exists, works there and answers the switchboard, then says what they agreed to say. The checks confirm the person and the employment and leave the honesty of the account untested, so ask for specifics a friend would have to invent, and add a referee you found yourself. - A front company built to last. A domain registered years ahead, a registry entry and a polished website pass the age and existence checks. The shell companies in the Justice Department case had web domains, financial accounts and "no employees or operations". A footprint written by other people over years, such as customers, news coverage and staff with histories of their own, is much harder to build. - A paid reference service that supplies a company email address and website, as People Management describes. The domain's age, the registry and the footprint expose it, and a call through a number you found yourself is the step it struggles to answer. - A main number taken from the wrong place. A number on a website the candidate controls reaches whoever the candidate chose. Take the number from a source the candidate could not have written, such as a directory, the company's filings or a page with an archived history. - Impersonation of a real employee. A real name at a real company, used from a lookalike domain or a personal address, passes the existence check. Reaching the person through the company is what catches it. #### Reading the evidence fairly Most references that look odd have an ordinary explanation, and a fair review checks for it first. - Many employers confirm only dates and job title as a matter of policy. The NPSA notes that "many employers only permit references to be provided by the HR department", and Acas, the UK's Advisory, Conciliation and Arbitration Service, [describes](https://www.acas.org.uk/providing-a-job-reference/what-employers-can-say-in-a-reference) a basic or factual reference as a short summary such as the employee's job title and dates, adding that "some employers only give basic references." A former manager who sends you to HR is following that policy. - Referees move on, and freelancers, consultants and staff at very small firms often use personal email. Someone who has left a company has no work address to give, so reach them through their current employer. - Small companies and founders leave thin records. A five-person firm may have a one-page website, and a founder may be the only person who can speak for the candidate's work there. The registry's list of officers fills part of the gap, and for periods of self-employment the NPSA suggests evidence that can include client references. - Names change. A referee or a candidate may appear in older records under a former or transliterated name, so ask before treating a missing record as a mismatch. Keep the levels apart. A personal address or a thin website means look further. A contradiction, such as a company with no record of the referee or a domain younger than the job, needs an explanation from the candidate. The NPSA reminds employers that "there may be a reasonable explanation for apparent inconsistencies" and advises raising concerns with the applicant. The FBI's [October 2026 update](https://www.ic3.gov/PSA/2026/PSA261013) on remote IT worker schemes makes a similar point: such workers "cannot be identified reliably with a single indicator", and aggressive controls risk "false positives that could harm legitimate employees". The CIPD's [selection methods factsheet](https://www.cipd.org/en/knowledge/factsheets/selection-factsheet/) cautions that references "provide a limited perspective of an individual's suitability for a role", so weigh them alongside everything else. #### Where Sixtyfour fits Checking referees by hand means looking up every name, company, domain and number a candidate supplies, and recording where each finding came from. Sixtyfour's agent starts from what you already have, such as a referee's name, email address, phone number or company, researches public sources such as company websites, registry filings and professional profiles, and links what it finds to the right person and company. Every finding comes with its source, and anything it could not establish is reported as open. It does not contact referees or replace the call through the company's main number, and a person on your team decides what to ask and whether to proceed. There is more on how hiring teams use it on our [workforce identity page](https://www.sixtyfour.ai/solutions/workforce-identity). #### The short version Check every referee through sources the candidate did not write: the company's own records, a call through its main number, and the email domain and phone number, read for whom they belong to. Compare the referee's account of the job with the candidate's and the references with each other, and ask the candidate about anything that does not fit before you decide. --- ### Money mule red flags: how to spot mule accounts *A mule account looks ordinary until you look at how money moves through it and who holds it. The account patterns investigators describe, how mules are recruited, and the research on the holder that helps tell a victim from a willing part of the scheme.* Source: https://www.sixtyfour.ai/blog/how-to-spot-money-mule-accounts Julian Wong · 2026-10-20 · Trust & Safety Money mule red flags show up in two places: in how money moves through an account, and in who the account holder turns out to be. In the account, look for money that passes straight through, payments from several unrelated people, and quick cash withdrawals, cryptocurrency purchases or onward transfers that the customer's history would not predict. In the holder, look for an identity with no past, a remote job moving payments for a company that cannot be found, a recruiter who leads back to a copied website or a free email address, and the same employer or contact details on other new accounts. This piece covers the types of mule, how people are recruited, the account patterns investigators describe and the research a reviewer can run on the holder, with a worked example. Many mules are victims of the people who recruited them, and that shapes how a fair review ends. Our guides to [detecting synthetic identity fraud](https://www.sixtyfour.ai/blog/how-to-detect-synthetic-identity-fraud) and [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) go deeper on two of the checks. #### What is a money mule? The FBI [defines a money mule](https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/money-mules) as "someone who transfers or moves illegally acquired money on behalf of someone else." Mules put distance between victims and criminals, which the FBI says "makes it harder for law enforcement to accurately trace money trails." The money is often somebody else's loss: the US Department of Justice [names](https://www.justice.gov/civil/consumer-protection-branch/money-mule-initiative) victims of romance, lottery, government imposter and technical support scams, and Europol [reports](https://www.europol.europa.eu/operations-services-and-innovation/public-awareness-and-prevention-guides/money-muling) that more than 90 percent of the mule transactions identified through its European Money Mule Actions are linked to cybercrime. The numbers are large and still being counted. Cifas, the UK's not-for-profit fraud prevention service, added a filing category for money muling in 2025, and its members [reported](https://www.fraudscape.co.uk/) more than 22,000 incidents to the National Fraud Database that year, 89 percent of them involving personal bank accounts. In the first half of 2026 they [filed](https://www.cifas.org.uk/newsroom/fraudscape-2026-6-month-update) nearly 13,000, up 70 percent on a year earlier, a rise Cifas says is likely to reflect wider use of the new category alongside better detection. UK Finance, which represents more than 300 banking and finance firms, [reports](https://www.ukfinance.org.uk/policy-and-guidance/reports/annual-fraud-report-2026) that data collected by its Intelligence Unit showed 12,438 money mules disrupted in 2025. In the US, one laundering organisation recruited more than 15,000 US-based mules to launder at least $10 million stolen from over 750 bank accounts, the Justice Department [said](https://www.justice.gov/opa/pr/ukrainian-russian-dual-citizen-pleads-guilty-running-international-money-laundering) when one of its leaders pleaded guilty in October 2026. #### What are the types of money mule? The FBI sorts mules by what they know. - Unwitting or unknowing mules "are unaware they are part of a larger scheme." They are often approached through an online romance or a job offer, and asked to use their own bank account to receive money from someone they have never met in person. - Witting mules "ignore obvious red flags or act willfully blind to their money movement activity." Some may have been warned by bank staff, and some "may have been unwitting at first but continue communication and participation." - Complicit mules "are aware of their role and actively participate." The FBI says they serially open bank accounts, advertise their services, run funnel accounts that collect money from lower level mules, and recruit others. Some mule accounts are opened in a name that is not the user's own. Europol [reported in 2023](https://www.europol.europa.eu/media-press/newsroom/news/paper-trail-ends-in-jail-time-for-1-013-money-mules) that organised mules travel to open accounts, "often using fake documentation", and Cifas says its intelligence indicates some people sell their personal information to criminal networks, which use it to open accounts. People move between the types. A Pennsylvania man who pleaded guilty in July 2026 had first fallen victim to a romance fraud, the [Justice Department says](https://www.justice.gov/usao-edpa/pr/fmr-dod-employee-pleads-guilty-to-laundering-millions-for-scammers), and then "knowingly served as a money mule for the same group of fraudsters that initially victimized him." He carried on after FBI agents told him the money passing through his accounts had been stolen from other people. Warnings far outnumber charges. In the Money Mule Initiative whose results the Justice Department announced in May 2024, US agencies [took action against more than 3,000 mules](https://www.justice.gov/archives/opa/pr/us-law-enforcement-takes-action-against-more-3000-money-mules-initiative-disrupt): about 2,970 received letters warning them that their actions were facilitating fraud, and more than 20 were criminally charged. #### How are money mules recruited? Job offers are one of the main routes. Europol describes "seemingly legitimate job offers" for roles such as money transfer agents, and the Justice Department says such positions "often have ill-defined responsibilities and involve little more than sending or receiving money or packages or opening accounts." In the laundering case behind the October 2026 guilty plea, the organisation deceived its mules into believing they worked for legitimate companies, and told them the job was to "receive payments from businesses into their personal bank accounts, withdraw the money, and then wire the funds to the fake company's partners overseas." The mules were never paid. Much of the recruiting happens on social media and messaging apps. Europol lists closed Facebook groups, Instagram, Snapchat and direct messages on apps such as WhatsApp and Telegram. Cifas calls social media "a key channel for luring new mules and advertising 'quick money' schemes". Online romances and friendships are the other main route. The Secret Service's [red flags](https://www.secretservice.gov/investigations/mule) include a partner met online who "claims to be unable to open a bank account and asks to use your account to transfer money." Young people are a frequent target. Europol says the most likely targets are people under 35, and that criminal groups have begun recruiting people aged 12 to 21. In Cifas's 2025 data, 18 percent of money muling cases involved people under 21 and 39 percent people aged 21 to 30. Europol also names newcomers to a country, unemployed people and people in economic hardship, and the FBI's caution covers everyone: "anyone can be approached to be a money mule." #### What does mule activity look like in an account? Law enforcement sources describe much the same signs. - Money that passes through. Europol describes a mule as someone who receives money from a third party into their bank account and "transfers it to another one or takes it out in cash". - Many unrelated senders. The Justice Department [says](https://www.justice.gov/civil/consumer-protection-branch/money-mule-initiative) money mules "are sent money by people they don't know and then, at the direction of someone else, provide the funds to other people." - Quick conversion. The Secret Service's signs include being asked to receive wires, withdraw cash and buy cryptocurrency. In the Pennsylvania case, the mules made "a series of rapid financial transactions" to turn victims' deposits into cryptocurrency and move it to foreign accounts. - A cut left behind. The FBI says unwitting mules may be told to keep a portion of the money they move. - A change in behaviour. An account that carried a part-time wage for months and then receives five-figure sums from strangers has changed, whatever the size of each payment. - More accounts, and paperwork. The FBI says witting mules open accounts with several banks, and the Pennsylvania defendant sent "fraudulent invoices to make the transactions appear legitimate." A pattern like this shows that money is moving through the account on someone else's behalf. It cannot show whether the holder knows, or whose identity the account was opened in. A mule account is ordinary until you look at how the money moves through it and who the holder turns out to be. The transactions answer the first half, and research on the person answers the rest. #### Is the account holder a real person? A real person has a past that other people wrote over years: school and employer pages, club and alumni listings, local news, professional profiles, and social accounts where friends reply. A synthetic or borrowed identity often has the documents and little of that history. Then check that the contact details belong to the same person. A phone number or email address on the person's own older pages supports the link. One that appears nowhere else, or under a different name, is a reason to look again, because stolen details arrive with a real person's footprint attached. The answer sorts the case. A real person with a real past, using their own contact details, fits one of the FBI's three types, and the question becomes what they knew. No past, or a past that belongs to someone else, points to an account opened with a synthetic or stolen identity, where the person whose details were used may be a victim too. #### Does the job or the employer exist? Many unwitting mules can explain why money is moving through their account, because they believe it is their job. Ask, and then check the story. - The company. Look it up in the registry where it says it is registered. Companies House gives [some details](https://www.gov.uk/get-information-about-a-company) of companies on its register for free, including the registered address, date of incorporation and officers, and the National Association of Secretaries of State [links to](https://www.nass.org/business-services/corporate-registration) each US state's business registration pages. A registry record shows that a company was filed, and leaves open whether it trades or hired anyone. - The website. ICANN's [Lookup tool](https://lookup.icann.org/en) shows a generic domain's public registration record, including the date it was created. A firm that claims years of trading and a site a few weeks old do not fit together. Europol warns that mule adverts "can copy a genuine company's website and have a similar web address", so compare the text with the company it resembles. - The email. The FBI and Europol both point to recruiters who write from free web-based email services instead of a company domain. - The job itself. The FBI's signs include duties with "no specific job description" and being allowed to keep part of the money. The Secret Service adds being asked to register a company and a business bank account, and an employer who "refuses to show their face on camera during video communications." - Other people's experience. The FTC [suggests](https://consumer.ftc.gov/articles/job-scams) searching the company or the person hiring with the words "scam," "review," or "complaint." These checks mirror the ones for a fake job applicant, and much of our guide to [spotting fake candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates) works in reverse. #### Where does the recruiter's advert lead? A holder who answered an advert often has more about the recruiter than they realise: the post, the profile that sent it, phone numbers, email addresses, a website and an offer letter. Research each one. - The advert. Note where it ran and under which account, then search for the same wording in other groups and on other platforms. The same script under a different company name links two adverts to one source. - The profile. Check when it was created, what else it has posted, and whether it connects to the company it claims to represent. - The contact details. Search each number and address for other adverts, complaints and accounts. - The evidence. Save each page with the date you saw it. The FTC notes that in reshipping job scams the phone number "is often no longer connected and the website is deactivated" by the time a recruit tries to get paid. Europol's advice is to report recruiting accounts "to the platform provider in order to be taken down", and a reviewer who has traced the advert is well placed to do it. #### Do other accounts share the same details or story? Recruiters rarely stop at one mule. In a [Florida case](https://www.justice.gov/usao-sdfl/pr/us-attorneys-office-and-law-enforcement-partners-take-action-against-money-mules-order), two men who pleaded guilty had been told to invite friends into the scheme, and the Justice Department says the group recruited "at least four additional, high-school-age participants." Once one account is flagged, search your own customers for what it shares: the employer named at onboarding, the recruiter's contact details, the people sending money in, the accounts receiving it, or the same explanation in the same words. Some of these values are rare and some common, and our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) covers how to weigh each one. The same unknown employer on three new accounts in two months is a strong lead to a common recruiter, and it says little about what each holder knew. #### What should you do when the holder looks like a victim? The Justice Department and Europol give someone used as a mule much the same advice: stop moving money, stop talking to the person giving directions, do not send that person any money still held, tell the bank and report it. Pass that on, explain what the job or the relationship really is, follow your own procedures for the account and the funds in it, and keep notes. Then report the recruiter. In the US, the FBI asks people to report money mule scams to its Internet Crime Complaint Center, the [IC3](https://www.ic3.gov/). In England, Wales and Northern Ireland, [Report Fraud](https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/) replaced Action Fraud in December 2025, and in Scotland reports go to Police Scotland on 101. #### A worked example The case is a composite. Wendmoor Freight Partners is invented, its domain uses the .example names [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and the phone number comes from the 555-0100 to 555-0199 range reserved for fictional use. A US fintech's monitoring flags an account opened five months earlier by a 22-year-old who gave her occupation as student, with part-time retail work. For four months it carried a paycheque every two weeks and small card payments. Then, over 19 days, 14 transfers arrive from 11 people in seven states, between $900 and $4,800 each and $36,200 in all. Most of each payment leaves within hours, as purchases at a cryptocurrency exchange or transfers to two accounts at other banks, and about 8 percent stays behind. The pattern shows money moving for someone else, and says nothing about who. The holder. Her name and home town match a person with a long public footprint: a university society page listing her as treasurer in 2024, school sports results from 2020, and a social profile active since 2018 where friends reply to her posts. The phone number on the account is the one on the society page. The identity is hers, and by every sign so is the account. The job. Asked about the payments, she says she works remotely as a "payment processing agent" for Wendmoor Freight Partners, passing its customers' payments to its suppliers for a commission. She found the job through an Instagram post in a student jobs group, and she shows the reviewer the recruiter's messages on Telegram. The employer. Wendmoor's website, wendmoorfreight.example, was created seven weeks earlier, according to its registration record. Its About page copies, paragraph for paragraph, that of an established freight company with a similar name in another state. The site says Wendmoor is registered in Delaware, and the state's registry has no entity of that name. The "hiring manager" writes from a free webmail address, the offer letter lists no duties beyond receiving and remitting client payments, and he declined a video call. The recruiter. The Instagram account behind the advert is six weeks old, has posted nothing but job adverts, and gives a contact number, +1 312 555 0147. The same advert, under a different company name, appears in two other jobs groups. Other accounts. Two of the fintech's customers, both onboarded in the last two months, give Wendmoor Freight Partners as their employer, and one lists +1 312 555 0147 as a work number. Put together, the account is being used as a mule account, and the evidence fits a holder who does not know what the job is: her identity is real, her story matches the recruiter's script, and she described the job freely. The team stops outgoing payments under its own procedures, explains to her what the job is, and passes on the Justice Department's advice to stop talking to the recruiter and send them nothing. It reports the advert to Instagram, files a complaint with the IC3 and opens reviews of the two linked accounts. Some questions stay open, and the file says so: who runs Wendmoor, whether the other two customers are victims or part of the recruiting, and where the money went after the exchange. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Transaction pattern | Money is passing through the account for someone else | Whether the holder knows, or who is directing it | | The holder's footprint over years | A real person with this name and history exists | That they opened or control this account | | Contact details on the account | The phone number and email belong to the person named | What that person knew | | Registry record for the stated employer | A company of that name was filed | That it trades, or that it hired the holder | | The employer's website and its age | When the site appeared, and whether it copies another company | Who runs it | | The recruiter's advert and profile | How the holder was approached, and where the same advert ran | Who the recruiter really is | | Details shared with other accounts | The accounts probably came through one recruiter or operator | That every linked holder is complicit | Count only independent evidence: a website and an offer letter that quote the same invented registration are one fact seen twice. #### What defeats these checks - A real person who rents out their account. Research confirms who they are and cannot read intent. The FBI says complicit mules advertise their services, "to include what actions they offer and at what prices", and a practised one may tell a rehearsed story. - A real identity used without its owner. Stolen details arrive with a genuine footprint, so tie the phone number and email address to the person as well as the name. - A borrowed company. When a recruiter uses a real company's name, the registry finds a real company. Contact it through its own website and ask whether it hires remote payment agents. - Short-lived recruiting accounts. Profiles, sites and numbers disappear quickly, so capture them the day you find them. - Deliberate variety. An organised group can give each mule a different employer, story and contact number, which leaves fewer shared details to link. #### Reading the evidence fairly Much of what makes an account look like a mule account can have an ordinary explanation, and a fair review checks for one first. - Plenty of genuine accounts receive money from many people: marketplace sellers, people collecting rent or shared bills, freelancers, and clubs collecting for an event. Ask what the customer does first. - Money that leaves quickly is normal for some customers, such as people who move their pay to savings at another bank or into investments. - A thin footprint is common among young people, newcomers to a country and anyone who keeps a low profile online. Europol notes that newcomers are also a recruiting target, so treat thinness as a reason to ask questions. - A company missing from one registry may be registered elsewhere or trade under another name. Check spellings and other registries first. - Age figures describe the cases Cifas and others have recorded, and say nothing about the person in front of you. - A holder who is open about the job is giving you evidence. Many are the recruiter's victims, and the Justice Department's warning letters are written for people who may have been unknowingly recruited. #### Where Sixtyfour fits Transaction monitoring raises the alert. The research that follows is what takes the time: who the holder is, whether the employer they name exists, and where the recruiter leads. Sixtyfour's agent starts from what you already have, such as the holder's name, email address or phone number, the employer on the application, or a recruiter's handle or website. It researches public sources such as registry filings, the web footprint, news and professional profiles, links what it finds to the right person or company, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not see transactions or check bank accounts. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version Read a flagged account in two parts. The transactions show money passing through for someone else, and research on the holder, the employer they name, the recruiter's advert and the other accounts that share the story shows whose account it is and whether they are likely to know. Treat an unwitting holder as the recruiter's victim, pass on the advice the Justice Department and Europol give, and report the recruiter. --- ### How to find out who owns an LLC *A state registry often shows little more than that an LLC was formed and who receives its legal papers. Where the names of its members and managers turn up, in its filings, deeds, liens, licences and footprint, and what each record proves.* Source: https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-an-llc Roham Mehrabi · 2026-10-19 · Trust & Safety To find out who owns an LLC, look it up in the registry of the state where it was formed, then read the documents it has filed there rather than the search result. Some states ask for an LLC's managers or members in its formation filing or a periodic report, while others, Delaware among them, record little beyond the registered agent. Where the registry stops, the names tend to appear in records an LLC creates as it does business: the signatures on its filings, deeds and mortgages, UCC financing statements, court cases, assumed-name filings, licences and, if it raises money, a Form D with the SEC. A signature shows who acts for the LLC, which is not always who owns it, so treat each name as a lead until a second, independent record agrees. This piece covers who is who inside an LLC, what registries publish, where else the names turn up and how to follow an LLC owned by another, with a worked example. Our guide to [verifying a vendor](https://www.sixtyfour.ai/blog/how-to-verify-a-vendor) covers the payment side of a new supplier, and our guides to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification) and [shell company red flags](https://www.sixtyfour.ai/blog/shell-company-red-flags) go further into company research. #### Who counts as the owner of an LLC? The owners of an LLC are its members. The [IRS puts it plainly](https://www.irs.gov/businesses/small-businesses-self-employed/limited-liability-company-llc): "Owners of an LLC are called members." Most states do not restrict who they can be, so members "may include individuals, corporations, other LLCs and foreign entities", and most states allow an LLC with a single member. Several other roles appear on the public record, and each is easy to mistake for ownership. - Managers run the LLC. California's [articles of organization](https://bpd.cdn.sos.ca.gov/llc/forms/llc-1.pdf) ask whether a new LLC will be managed by one manager, more than one manager or all of its members, and in a manager-managed LLC the people running it may own nothing. - The organiser signs and files the formation document. Texas's [instructions](https://www.sos.state.tx.us/corp/instructions/205.shtml) accept as organiser any adult or any company, with no residency requirement, so the name on that line may belong to someone paid to do the filing. - The registered agent accepts legal papers for the LLC. California's [filing instructions](https://bpd.cdn.sos.ca.gov/llc/forms/llc-12.pdf) describe the agent as "responsible for accepting legal documents", such as lawsuits and subpoenas, on its behalf. - The authorised person signs filings for the LLC. Delaware's [certificate of formation](https://corpfiles.delaware.gov/LLC_Forms/LLC%20Formation.pdf) asks for the signature of "an authorized person of the limited liability company", with that person's name typed or written under it. In California the operating agreement is not on the public record either: the secretary of state says operating agreements "are maintained by the business entity and are not filed with the Secretary of State." So the public record more often shows the people who manage the LLC, sign for it or receive its papers than the members who own it. #### What does the state registry show? Start with the registry of the state where the LLC was formed, usually the secretary of state. The National Association of Secretaries of State [links to each state's](https://www.nass.org/business-services/corporate-registration) business registration pages and name databases. Delaware shows how little a registry may hold, and it is where 235,393 LLCs were formed in 2025, 70.4 percent of all new entities there, according to the Division of Corporations' [2025 annual report](https://corpfiles.delaware.gov/Annual-Reports/Division-of-Corporations-2025-Annual-Report.pdf). Its free [entity search](https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx) returns "the entity name, file number, incorporation/formation date, registered agent name, address, phone number and residency", and more costs a fee. The certificate of formation asks for the LLC's name and its Delaware registered agent, and the Division's [tax page](https://corp.delaware.gov/alt-entitytaxinstructions/) says there is "no requirement to file an Annual Report." So a Delaware LLC's public record usually names no member or manager, and beyond the agent the likeliest name on it is the authorised person who signed the certificate, on a copy ordered from the Division. Texas states the gap directly. Its secretary of state's [FAQ](https://www.sos.state.tx.us/corp/managementinfofaqs.shtml) says: "The secretary of state does not maintain any information on the ownership of a LLC." It holds the initial members of a member-managed LLC, the registered agent and the registered office. A registry entry shows that the LLC was formed and who receives its legal papers, and the people behind it are often somewhere else. Open the formation document, every amendment and every periodic report, and note who signed each one and the title they gave. #### Which states list an LLC's members or managers? Several do. California, Texas and Florida show the range. - California. Every California LLC, and every out-of-state LLC registered there, files a [Statement of Information](https://bpd.cdn.sos.ca.gov/llc/forms/llc-12.pdf) within 90 days of registering and every two years after. It gives the name and business or residential address of each manager or, if there are no managers, of each member, and of any chief executive officer. Plain copies of filed documents are [available online for free](https://www.sos.ca.gov/business-programs/business-entities/faqs). - Texas. The [certificate of formation](https://www.sos.state.tx.us/corp/forms/205_boc.pdf) names each initial manager or, if there are none, each initial member, and each can be "an individual or an organization". Texas also collects a yearly [Public Information Report](https://comptroller.texas.gov/help/franchise/public-info-report.php?category=taxes) with each LLC's franchise tax report, listing all its managers and, if it is member-managed, all its members. The secretary of state makes that information public, noting that it "is not necessarily current". - Florida. The [articles of organization](https://files.floridados.gov/media/702398/cr2e047.pdf) ask for the name and address of each person authorised to manage and control the LLC, marked AMBR for an authorised member or MGR for a manager, an entry the form calls optional. The annual report asks for at least one manager or managing member, whose address may be a post office box. A manager-managed LLC can list its managers without naming a single member, and a filing can name a company where you expected a person. Check every state where the LLC operates, too: an out-of-state LLC registered in California files the same Statement of Information as a local one, so a Delaware LLC can name its managers there. #### Where else do the names of owners and managers appear? An LLC that borrows, owns property, goes to court, trades under another name or holds a licence leaves names in other public records, each showing a different relationship to it. Property records. County recorders index deeds and mortgages by the names of the parties. Cook County's [recordings division](https://www.cookcountyclerkil.gov/recordings) says its land records "can be retrieved by searching for PIN, grantor, grantee, and by other indexed detail". Open the documents. A mortgage or deed of trust the LLC signed names the person who signed for it, and in California the notary's acknowledgement names the person who appeared and records that they signed in their "authorized capacity". California's [notary handbook](https://notary.cdn.sos.ca.gov/forms/notary-handbook-current.pdf) says the certificate "verifies only the identity of the individual who signed the document". County tax records add the address the bill goes to, and some, such as [Tarrant County's](https://www.tax.tarrantcountytx.gov/Search/) in Texas, can be searched by "the owner's mailing address", which can link properties mailed to the same place. UCC financing statements. A lender that takes an LLC's assets as security can file a financing statement with the secretary of state, giving the debtor's and the secured party's names and addresses, and a statement can name more than one debtor. In California, [most financing statements](https://www.sos.ca.gov/business-programs/ucc/faqs) lapse after five years, and the party names stay in the searchable index for a further year. Court records. Federal cases are on [PACER](https://pacer.uscourts.gov/pacer-pricing-how-fees-work), where fees are waived for anyone who spends $30 or less in a quarter. State courts run their own searches. Read the filings for the people who acted for the LLC, such as whoever verified a complaint or gave evidence for it. Assumed names. An LLC that trades under another name may have filed a fictitious business name statement, filed in California with the county of its principal place of business. Los Angeles County's [filing rules](https://www.lavote.gov/home/county-clerk/fictitious-business-names) ask for the owner's signature, which for a limited liability company means a "manager or officer". This is the record that ties a trading name on an invoice to the legal entity behind it. Licensing boards. California's contractors board asks an LLC applying for a [licence](https://www.cslb.ca.gov/about_us/llc.aspx) to list "Every person who is an officer, member, responsible manager, or director" as personnel of record, and its public licence pages link to a list of the personnel associated with the licence. SEC filings. An LLC that has raised money from investors in certain private offerings may have filed a [Form D](https://www.sec.gov/files/formd.pdf), whose related persons section names each executive officer, director and person performing similar functions, "such as ... managing members of limited liability companies", and any promoters. EDGAR's [full-text search](https://www.sec.gov/edgar/search/efts-faq.html) covers every electronic filing since 2001, exhibits included, so it can also find an LLC named in another company's filings. Your own vendor file. If you pay the LLC, you may already hold its W-9, and the [form](https://www.irs.gov/pub/irs-pdf/fw9.pdf) says whose name goes where. An LLC with a single owner is generally a "disregarded entity", which gives "the owner's name on line 1" and its own name on line 2, and if that owner is also disregarded, line 1 shows "the first owner that is not disregarded for federal tax purposes." Its footprint. The LLC's website, domain record, press coverage and the profiles of people who say they run it show who presents themselves as behind it, and since when. Our guide to [finding out who owns a website](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website) covers the domain side. #### How do you find the owner of an LLC owned by another LLC? Treat the parent as a new search. Members can be other LLCs, so the member or manager in a filing may be a second company. Find the state where that company was formed, read its filings there and in the states where it operates, and run the same checks on its deeds, liens and assumed names. Record each link with its source, and keep going until the chain reaches a person or a record that names no one. Some links are stronger than others. - A person who signs for two layers, such as the manager of the parent who also signs the child's deed of trust, links them through documents each one signed. - An address that repeats across layers, on a Statement of Information, a financing statement and a tax bill, is a second link, as long as it is not a registered agent's address shared with other clients. - For a payer, the W-9 can skip ahead, because line 1 names the first owner that is not disregarded. Even a person who signs for every layer should stay in the file as a signer until something shows ownership. #### Why is the address on file someone else's? Because the address may be the registered agent's, or one chosen to keep a home off the record. California's form lets an LLC name either an individual in California or "a registered corporate agent qualified with the California Secretary of State", and adds that "Many times, a small LLC will designate a member or manager as the agent". Delaware publishes a [list of registered agents](https://corp.delaware.gov/agents/), many of them businesses offering the service. An agent's address tells you who receives the LLC's legal papers and nothing about who owns it. The same form reminds filers that the agent's name and street address are "a public record, open to all (as are all the addresses of the LLC provided in filings)", and it accepts a business address for each manager or member, so a manager listed at an office or a mailbox is ordinary. #### A worked example The case is a composite. Quillmarsh Facility Services, Mossgarth Holdings, Mossgarth Cleaning and Marisela Delvarra are invented, the domain uses the .example name [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and the phone number comes from the 555-0100 to 555-0199 range reserved for fictional use. A distribution company in California is asked to add Quillmarsh Facility Services LLC as a vendor, to clean and maintain two warehouses for about $11,500 a month, on the recommendation of a site operations manager. The vendor form gives an email address at quillmarsh.example and a phone number, +1 559 555 0143. The W-9. Line 2 gives Quillmarsh's name and line 1 names Mossgarth Holdings LLC, which is where the form puts the owner of a single-owner LLC, or the first owner up the chain that is not disregarded. The classification box is marked LLC, P for partnership, which describes Mossgarth, and since the IRS treats a one-member LLC as disregarded or, by election, as a corporation, never as a partnership, Mossgarth has at least two members. The registry. Delaware's free search shows Quillmarsh was formed there in March 2026, with a commercial registered agent in Wilmington, and nothing else. In California it registered as an out-of-state LLC in April 2026, and its Statement of Information names one manager, Mossgarth Holdings LLC, at an address in the Central Valley, and no chief executive officer. The parent. Mossgarth Holdings is a California LLC formed in 2018. Its latest Statement of Information names one manager, Marisela Delvarra, at the same address, and, as a manager-managed LLC, no members. The records. Three documents the accounts payable (AP) team found separately tie Mossgarth to that address and to her. - At the county recorder, a 2022 deed of trust on an industrial unit Mossgarth bought that year is signed for the LLC by Marisela Delvarra as manager, and the notary's acknowledgement names her. - A 2024 financing statement lists Mossgarth Holdings as debtor and an equipment lender as secured party, at the same address. - A fictitious business name statement filed with the county in 2023 registers Mossgarth Cleaning to Mossgarth Holdings LLC, signed by Delvarra as manager. The match. Searching the vendor master file for the address on Quillmarsh's Statement of Information turns up Mossgarth Cleaning, which has cleaned a third warehouse since 2024 for about $9,000 a month. Quillmarsh's website, on a domain registered in March 2026, gives the same phone number as Mossgarth Cleaning's. Put together, Quillmarsh belongs, on its own W-9 and its California filing, to the company behind an existing vendor, and is managed through that company by Marisela Delvarra. A new LLC for new contracts is an ordinary choice. But each contract sits under the $15,000 a month above which the company's policy sends a supplier to procurement review, and together they do not. The AP team links the two vendor records, sends the pair to procurement and asks the site operations manager for the conflict-of-interest declaration the policy requires when an employee recommends a vendor. He declares no interest, and says Delvarra told him a new company would take the new contracts. One question stays open, and the file says so: who Mossgarth's other members are. No public record the team found names them, so it asks Delvarra for a list and records her answer as the vendor's own statement. #### What each check proves | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Registry search result | The LLC was formed, when, and who its registered agent is | Who owns or runs it | | Statement of Information or annual report | The managers, or the members if it has no managers, as last reported | The members of a manager-managed LLC, or anything that changed since the report | | Formation filing and its signer | Who set the LLC up or filed for it | Whether the organiser or authorised person has any stake | | Deed of trust and notary's acknowledgement | Who signed for the LLC, and the capacity they claimed | Whether the signer owns it, since a California notary verifies identity only | | UCC financing statement | A lender claimed the LLC's assets as security, who the lender is and the address given | Who owns it | | Fictitious business name statement | Which LLC trades under a name, and who signed for it | The LLC's members | | Licensing board record | The people the board required on the licence | Their ownership shares | | Form D | The managing members or similar officers, and any promoters, when the LLC raised money | Who holds the interests today | | W-9 in your vendor file | The first owner that is not disregarded for tax, in the vendor's own words | Anything the vendor left out | | Footprint and news | Who presents themselves as running it, and since when | Legal ownership | Two records count as two only if neither was copied from the other. #### What defeats these checks - Formation in a state whose record names only the agent, at every layer. A Delaware LLC owned by another Delaware LLC leaves a search very little to follow, and a chain that stops there has to be recorded as a dead end. - A stand-in's name on the filing. In a case the Justice Department [announced in August 2026](https://www.justice.gov/usao-mdtn/pr/former-bridgestone-americas-assistant-treasurer-pleads-guilty-nearly-15-million-wire), a former assistant treasurer at Bridgestone Americas pleaded guilty to two counts of wire fraud over invoices from a fictitious vendor he created, Paymt-Tech, LLC. According to the release, he "registered the company in Nevada under the name of an acquaintance", and Bridgestone paid $14,923,978.57 into its accounts over nearly four years. - Professional names. Organisers, authorised persons and agents can be paid filing agents or advisers, whose names are real and show only who did the paperwork, and a California notary's certificate verifies identity alone. - Stale filings. California's Statement of Information is renewed every two years, and in between only if the LLC files an update. Texas notes that its management records are "not necessarily current". A name can be right on the date of filing and wrong today. - A foreign member. When a layer is a foreign company, the chain moves to a registry abroad, and that registry decides how far it goes. #### Reading the evidence fairly Most LLCs with thin records belong to ordinary businesses, so a fair review checks the ordinary explanation first. - A manager listed at an office or a post office box may simply be keeping a home address off a public filing, which the forms allow. - A commercial registered agent is normal, and so is an agent's address on file. - An LLC owned by another LLC may simply be part of a group with a holding company at the top. - A manager may own nothing, and an owner may manage nothing. Read the title on each filing. - Names collide. A match between a filing and a person needs two independent details, such as a name and an address at the same date. - Filings lag. A recent change of manager may not show until the next report. Keep three levels apart. A thin record means look further. A contradiction, such as a new vendor that turns out to share an owner with an existing one, calls for a question. Two independent records that agree, or the LLC's own written disclosure, settle what they cover, and the file records what they leave open. #### Where Sixtyfour fits Following an LLC through registries, property and lien records and its web footprint is slow by hand, and the hard part is keeping each link tied to its source. Sixtyfour's agent starts from what you already have, such as a company name, a person's name or a website, researches public sources such as registry filings, public records and the web footprint, links what it finds to the right company and people, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version Find the LLC in the registry of the state where it was formed and in every state where it is registered to do business, and read its filings for the managers, members and signers they name. Then follow those names into the records the LLC creates as it does business, from deeds and liens to assumed names, licences and SEC filings, trace any parent company the same way, and treat each name as a lead until a second, independent record agrees. --- ### How to verify a vendor before you pay them *A real supplier can be impersonated and a fake one can look real. The checks that separate them, what each one proves, why a change of bank details is the moment to stop, and what to do if the money has already gone.* Source: https://www.sixtyfour.ai/blog/how-to-verify-a-vendor Roham Mehrabi · 2026-10-16 · Trust & Safety To verify a vendor before you pay them, check two things separately: that the business is real and is the one you think you are dealing with, and that the bank account on the invoice belongs to it. The first comes from public records: the company registry, the domain the vendor emails from, the people who sign its messages and the footprint it has built up with other customers. The second comes from one step: calling the vendor on a number you already hold, not one supplied with the request, and confirming the account before any money moves. A change of bank details is the moment that call matters most. This piece takes the checks in the order an accounts payable team can run them, with what each one is evidence of and a worked example. Our guides to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification) and [shell company red flags](https://www.sixtyfour.ai/blog/shell-company-red-flags) cover deeper company research. #### Two ways a vendor payment goes wrong Vendor payment fraud takes two main shapes. The first is an impersonated vendor: the supplier is real and you owe it money, but someone gets between you and it, usually with an email asking you to pay into a new account. [UK Finance](https://www.ukfinance.org.uk/policy-and-guidance/reports/annual-fraud-report-2026), which collects fraud data from banks and payment providers, describes invoice and mandate scams as cases where the victim tries to pay a legitimate payee and the criminal convinces them to redirect the payment, including by "posing as a supplier, and claiming that the bank account details have changed". It adds that this fraud often involves "intercepting emails or compromising an email account". The second is a fake vendor, set up to collect payments for work nobody did. Sometimes it is an outsider. The US Federal Trade Commission [warns](https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business) that scammers "create phony invoices that look like you ordered products or services for your business". Sometimes it is an insider. In the Association of Certified Fraud Examiners' [2026 study](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf) of 2,402 occupational fraud cases, billing schemes, a category that includes an employee who "creates a shell company and bills employer for services not actually rendered", appeared in 21 percent of cases, with a median loss of $90,000. The FBI's Internet Crime Complaint Center (IC3) [received 24,768 complaints](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) of business email compromise in 2025, with reported losses of just over $3 billion, the largest loss of any crime type after investment fraud. In the UK, invoice and mandate scams cost £41.3 million in 2025, down 4 percent on 2024, and 68 percent of those losses were on business accounts. UK Finance gives the reason AP teams will recognise: businesses "make genuine higher-value payments more regularly, making it harder to spot and stop a fraudulent one." #### Why a change of bank details is the moment to stop In an impersonation, the theft happens when the payment destination changes, because every later payment follows the new account. The Association for Financial Professionals [surveyed 465 corporate professionals](https://www.financialprofessionals.org/training-resources/resources/survey-research-economic-data/details/payments-fraud) in January 2026 about the year before. The AFP reports that about three in four organisations were affected by business email compromise in 2025, and found that fraudsters "primarily impersonate vendors or executives to request changes to payment instructions". One respondent described a scammer who "took over the email box of one of our key vendors" and sent fake invoices that were "processed in the normal way with all approval steps", while asking for a bank change "which was entered into the system before Treasury could confirm the same". The invoices named the right supplier, came from its real address and were approved at every step. Only the account was wrong. The bank account is the one detail a fraudster has to change, so it is the one detail to confirm, on a number you already hold. #### How do you verify a change of bank details? Treat every request to change where you pay a vendor as unverified until someone has confirmed it by a second route. The IC3 [advises businesses](https://www.ic3.gov/PSA/2024/PSA240911) to "use secondary channels and/or two-factor authentication to verify requests for changes in account information", and the UK's National Cyber Security Centre [recommends](https://www.ncsc.gov.uk/guidance/phishing) that "all important email requests are verified using a second type of communication". In practice: 1. Call the vendor on a number you already hold: from your vendor master file, the signed contract or an invoice you have already paid. Use none of the numbers in the email, letter or attachment that asks for the change, and if the number in your file was itself changed recently, verify that change first. 2. Ask for someone you have dealt with before, and have them confirm the old account, the new account and the reason for the change. 3. Hold any payment to the new account until the call is done, and have a second person approve the change in your system. 4. If your bank offers a check of the name on the receiving account, use it. In the UK this is Confirmation of Payee, which [Pay.UK describes](https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/faqs/) as "an account name checking service designed to help reduce misdirected payments". A close match shows you the actual account name to check, and a no match advises you to contact the organisation you are trying to pay. Finance teams rate the callback highest. In the AFP's 2026 survey, 94 percent of organisations verified fund transfer requests "by calling an authorized contact at the payee organization using a phone number from official records, not from email", and 63 percent of those using it rated it very effective, the largest share for any of the eight controls the survey listed. Where the number comes from matters as much as the call. A call to a number supplied in the request confirms only that whoever wrote the request answers the phone. In another case from the same survey, someone posing as a client sent new banking details, and "AP called the number on the email to confirm the banking details." #### How do you check that a vendor is real? For a vendor you have not paid before, check the business itself before the first payment. Is it registered, and is the registration current? In the UK, Companies House gives [free details](https://www.gov.uk/get-information-about-a-company) of any company on its register, including its registered address, date of incorporation, current and resigned officers and previous names, and records a [status](https://developer-specs.company-information.service.gov.uk/companies-house-public-data-api/resources/companyprofile?v=latest) such as active, dissolved or in liquidation. In the US, companies register with a state, usually through the secretary of state's office, and the National Association of Secretaries of State [links to each state's](https://www.nass.org/business-services/corporate-registration) business registration pages and name databases. Free searches vary: Delaware's [entity search](https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx) returns active and inactive entities alike and says a result "is not an indication of the current status of an entity". A certificate of status, ordered for a fee, confirms it. Check the legal name on the invoice and the bank letter against the registry's spelling. Our [KYB guide](https://www.sixtyfour.ai/blog/kyb-verification) explains why a registry match shows a filing exists and leaves open whether the business trades. Do the people exist and work there? Look up the people who sign the vendor's emails and invoices on its website, in its filings and in their professional history. In a [2022 joint advisory](https://www.ic3.gov/CSA/2022/221216.pdf), the FBI, the FDA's Office of Criminal Investigations and the US Department of Agriculture described a sugar supplier that noticed an extra letter in the email domain of a would-be buyer and "independently contacted the actual company to verify there was no employee by that name working there". The same advisory lists fraudsters "using the names of actual officers or employees of a legitimate business" among their tactics, so a real name says nothing about who wrote the email. Does it have a footprint built by other people? A trading business leaves traces it did not write itself: customers who mention it, reviews built up over years, trade association memberships, news. The joint advisory recommends verifying a new vendor's contact details "through reputable online sources like associations or business directories", and the FTC suggests searching a new company's name online with the words "scam" or "complaint" before doing business with it. Our guide to [adverse media screening](https://www.sixtyfour.ai/blog/adverse-media-screening) covers telling whether a news hit is about the vendor or a namesake. #### How do you spot a lookalike email domain? Compare the domain on every payment-related email with the domain in your vendor file, character by character. The joint advisory describes fraudulent addresses that "include extra letters or words, substitute characters", such as the number 1 for a lower-case l, "or use a different top level domain". The [IC3 adds](https://www.ic3.gov/PSA/2024/PSA240911) that you should check that "the sender's address appears to match who it is coming from". Then date the domain. For a generic domain such as .com, the public registration record includes the date the domain was created. ICANN's [Lookup tool](https://lookup.icann.org/en) reads that record through RDAP, which [replaced WHOIS](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) as the definitive source of the data in January 2025. A supplier you have paid for years rarely starts emailing from a domain registered last week. Our guides to [finding out who owns a website](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website) and [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) go further. A matching domain is still not proof. When the vendor's own mailbox is compromised, the email comes from the right address, often inside a real thread. In the AFP's 2026 survey, 39 percent of organisations said they continue to receive genuine emails that have been intercepted by fraudsters. That is why the callback comes first and the domain check second. #### What each check proves | Check | What it shows | What it leaves open | | --- | --- | --- | | Callback on a number you already hold | The vendor you know made, or did not make, the request | Whether the number in your file was changed by an earlier request | | Bank's account-name check, where offered | Whether the name on the receiving account matches the one you entered | Whether that account holder is your vendor or a namesake | | Registry record | A company with this name and number exists, with a status, an address and, where the registry lists them, its officers | Whether it trades, and whether it sent the invoice | | The named people | The people in the emails exist and work at the vendor | Whether they wrote these emails | | Email domain and its creation date | Whether the address matches your file, and how old the domain is | Whether a matching mailbox has been compromised | | Operating footprint | Other people have dealt with the business over time | Whether this request came from it | Count only independent evidence: a registry record and a website that copies its address are one fact seen twice. #### How much checking does a payment need? Set the depth by the risk. - Every change of bank details, for every vendor: a callback on a number you hold, a second approver, and an account-name check where your bank offers one, whatever the size of the payment. - Every new vendor, before the first payment: the registry record, the named contacts, and the email domain and its age. - A new vendor with a large first order, an account that does not fit it, such as one in another country, or pressure to pay quickly: the footprint and adverse media checks too, and a call on a number you found yourself. - Existing vendors: watch for change. Companies House offers [free email alerts](https://www.gov.uk/get-information-about-a-company) when a company updates its details, such as a change of director or address. #### Controls that keep the checks in place A check that depends on one person remembering it under deadline pressure will eventually be skipped. These controls make it part of the process. - Separate the people who can create vendors or change their bank details from the people who approve payments, so that one person cannot do both. - Accept no bank change on the strength of an email alone. In the AFP's 2026 survey, 96 percent of organisations had "established policies to verify changes to invoices, bank deposits and contact details", and 91 percent prohibited "payment initiation based on emails or other less secure messaging systems". - Require senior sign-off above a payment threshold. In the same survey, 94 percent of organisations did. - Hold the first payment to a changed account until the callback is done, and consider a short hold after that too, so that the real vendor would notice a missing payment before much money moves. - Tell your vendors how you handle changes. The NCSC suggests telling suppliers and customers what to look out for, with messages such as "our bank details will not change at any point". A buyer can tell its vendors that every change to their bank details will be confirmed by a call to the number on file. Genuine vendors then expect the call, and pressure to skip it stands out. #### A worked example The case is a composite. Kemberwick Packaging is invented, its domains use the .example names [reserved for documentation](https://www.rfc-editor.org/rfc/rfc2606), and its phone numbers come from the 555-0100 to 555-0199 range reserved for fictional use. A food manufacturer in Ohio has bought corrugated boxes from Kemberwick Packaging for six years, paying by wire to the same account. In September 2026 its AP team receives an email from Kemberwick's accounts team about two open invoices totalling $184,000. It quotes real earlier messages, is signed with the name of Kemberwick's real finance manager, and says Kemberwick has moved its banking. An attached letter on Kemberwick letterhead gives a new account at a different bank, in another country, and asks for payment by Friday. The domain. The email comes from accounts@kernberwick.example. The vendor file says kemberwick.example. Read quickly, rn passes for m. An RDAP lookup shows the lookalike domain was created eight days earlier. The quoted thread is genuine, so whoever sent the email has read the real correspondence, most likely through a compromised mailbox at one end. The people. The finance manager named in the signature appears on Kemberwick's website. The name is real, which shows the sender knows whom to impersonate and nothing more. The phone number. The signature gives a direct line, +1 614 555 0182. The vendor file holds Kemberwick's main number, +1 614 555 0137, taken from the contract. The AP lead calls the number from the file. The callback. Kemberwick's main line puts her through to the finance manager, who has not changed banks, did not send the email and has been wondering why the invoices are late. The registry. Kemberwick's state registration is active and unchanged, because the fraud never touched the company. It touched the correspondence. Put together, the request is an impersonation. The new domain, its age and an account abroad for a local supplier were each reason enough to call, and the call settled it. The manufacturer pays both invoices into the account on file, keeps the emails with their full headers, reports the lookalike domain to its registrar's abuse contact, files a complaint with the IC3 and tells Kemberwick, whose mailbox or a correspondent's needs checking. Who sent the email stays open, and the file says so. #### What to do if you have already paid The IC3's [guidance](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) begins: "If you discover a fraudulent transfer, time is of the essence." Call your bank at once on its official number, ask it to recall the payment and give it the full transaction details. Then report it. - In the US, [file a complaint with the IC3](https://www.ic3.gov/), which asks for one "regardless of the amount lost", with the full transaction details. Its Recovery Asset Team works with banks to freeze funds, and in 2025 it ran that process on 3,900 incidents involving $1.16 billion of attempted theft and froze $679 million, a 58 percent success rate. - In the UK, the NCSC [advises](https://www.ncsc.gov.uk/section/respond-recover/ml-business-payment-fraud) contacting your bank directly, using its official website or phone number. Report the fraud to [Report Fraud](https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/), which replaced Action Fraud in December 2025 for England, Wales and Northern Ireland, or to Police Scotland on 101. UK Finance's figures show that £10.6 million of the £28 million lost to invoice and mandate scams on business accounts in 2025 was returned, a little under two-fifths. Keep the emails with their full headers, the bank letter, call notes and payment records. Tell the real vendor, whose mailbox may be the compromised one, and have your IT team check yours. #### What defeats these checks Each check has a known way around it. - A compromised vendor mailbox passes every domain check. The callback is what catches it, which is why it comes first. - A callback to a number the fraudster supplied reaches the fraudster. The number has to come from your own records. - A cloned voice can sound like a contact you know. The IC3 warns that "voice cloning can also be used to request wire payment", and businesses reported more than $30 million in losses in 2025 to business email compromise involving AI. A call you place to a number you hold is much harder to fake than a call you receive. - An insider can create a vendor and approve its invoices. The ACFE found that billing schemes ran a median 14 months before they were detected. Separating who sets up vendors from who approves payments is the control, and the registry and footprint checks show whether a vendor has any history outside your ledger. A registered company can still be a front, which our [shell company guide](https://www.sixtyfour.ai/blog/shell-company-red-flags) covers. #### Reading the evidence fairly Most of what makes a vendor request look odd has an ordinary explanation, and a fair review checks it first. - Vendors do change banks, after mergers or when they move to a new bank. The callback answers those requests too, and it is the same call whether the request is real or not. - New and small vendors are thin. A sole trader may have no website, no reviews and a free email address. Ask for different evidence: a call, a reference from another customer, a registration document. - An account-name check can return a close match or no match on a genuine account. The service's guidance is to enter a business's registered name or a trading name registered to the account, so an invoice that uses another trading name can produce a mismatch. A mismatch is a reason to call. - A second domain is not always a lookalike. Businesses buy domains for new brands and acquisitions, and the callback tells the two apart. - A vendor that checked out can change. Run the checks again when its details change, and every time its bank details do. #### Where Sixtyfour fits For a new supplier, the checks on the business take the longest by hand. Sixtyfour's agent starts from what you already have, such as a company name, a director or a website, researches public sources such as registry filings and the business's web footprint, links what it finds to the right company and people, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not check bank accounts or replace the callback. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version Treat every change of vendor bank details as unverified until you have confirmed it on a phone number you already hold, with a second approver and an account-name check where your bank offers one. Before paying a new vendor, check its registry record, the people who sign its emails, its email domain and that domain's age, and the footprint other people have left. If money has already gone, call your bank to request a recall and report it straight away. --- ### How to tell if a LinkedIn profile is fake *A polished profile proves little. How to read a profile's age, badges, history and photo, look for the person outside LinkedIn, and weigh what each check is evidence of.* Source: https://www.sixtyfour.ai/blog/how-to-tell-if-a-linkedin-profile-is-fake Julian Wong · 2026-10-16 · Trust & Safety To tell if a LinkedIn profile is fake, check its history before its polish. Open the profile's About this member panel (LinkedIn's older name for it is About this profile) to see when it was created and what has been verified, read the work history for details that can be checked, run the photo through a reverse image search, and then look for the person outside LinkedIn, in records other people wrote about them over the years. A real career leaves those traces, and a fake profile usually has the career without them. No single check settles the question, so weigh them together. #### How common are fake LinkedIn profiles? LinkedIn, which says it has over 1.3 billion members, [reports](https://about.linkedin.com/transparency/community-report) that between July and December 2025 it stopped 88.9 million fake accounts at registration, restricted 24.4 million more before any member reported them, and restricted 361,300 after members did. LinkedIn says 99.7 percent of the fake accounts it stopped were stopped before a member report. The fakes that reach you are the ones those defences missed. They come in three kinds, and each needs slightly different checks. An invented person. NPR reported in March 2022 that Renée DiResta and Josh Goldstein of the Stanford Internet Observatory had found [more than 1,000 LinkedIn profiles](https://www.npr.org/2022/03/27/1088140809/fake-linkedin-profiles) using what appear to be AI-generated faces. More than 70 businesses were listed as employers. Several told NPR they had hired outside marketers to help with sales, but said they had not authorised computer-generated images. A real person, impersonated. The FBI [warned in 2024](https://www.ic3.gov/PSA/2024/PSA240903) that North Korean cyber actors impersonate people including "general recruiters on professional networking websites", using "pictures stolen from open social media profiles of the impersonated individual." A real person with an invented history. The name and face are genuine, and some of the jobs, titles or degrees are not. The checks in our guide to [verifying a resume](https://www.sixtyfour.ai/blog/how-to-verify-a-resume) apply here. #### When was the profile created? On the profile, click More and choose About this member. LinkedIn [introduced the panel in 2022](https://www.linkedin.com/blog/member/trust-and-safety/new-linkedin-profile-features-help-verify-identity-detect-remove-fake-accounts-boost-authenticity), as About this profile, to "show you when a profile was created and last updated", and it is also where verifications appear: LinkedIn's help pages say a workplace verification [may be visible](https://www.linkedin.com/help/linkedin/answer/a1453679) "in the About this member section". A creation date tells you how long the profile has existed, and nothing about the career it describes. A profile opened this year that claims fifteen years of work is not evidence of fraud, since people join late or delete an old account and start again, but it cannot vouch for its own history. A profile opened years ago, with activity spread across those years, carries some of its own evidence. Read any recent change the same way. An old profile that recently got a new photo, headline and location may belong to someone who changed jobs, or may be an account that changed hands. #### Can a fake profile have a verification badge? Yes, although a badge narrows what can be fake. Two of LinkedIn's [verifications](https://www.linkedin.com/help/linkedin/answer/a1359065) matter here, and both show as a badge beside the member's name to anyone logged in: - Identity verification means "a member's government-issued ID was verified by one of LinkedIn's verification partners", and the name used "must match the name on your LinkedIn profile." - Workplace verification means the member "has confirmed their association with the specific company", through a work email, Microsoft Entra Verified ID, or a LinkedIn Learning or LinkedIn Recruiter licence provided by the company. A work email [must match](https://www.linkedin.com/help/linkedin/answer/a1423367) "your current company's email domain." In September 2025, LinkedIn told reporters it would require workplace verification when a member adds or updates a recruiter title, or a senior title such as vice president, [Help Net Security reported](https://www.helpnetsecurity.com/2025/09/04/linkedin-expands-company-verification-workplace-checks/), quoting LinkedIn's vice president of trust product. Members who already held those titles were not asked to verify straight away, and LinkedIn's help pages say only that members "may need to complete workplace verification to add or edit your work experience." LinkedIn is also [testing a third kind](https://news.linkedin.com/2026/linkedin-launches-new-verification-features-to-build-professional-trust), announced in September 2026: it asks verified members to confirm the work or school experience of connections they worked or studied with, and "Once someone receives enough confirmations, LinkedIn adds a verification badge". Most profiles will not show it yet. The same announcement lets companies that have verified their LinkedIn Page remove impostors from search results under the company's name. So an identity badge shows that a verification partner checked a government ID and that LinkedIn matched it to the profile's name, or to an alias it could confirm, not that the jobs, schools or photo are real. A workplace badge shows that someone with access to the company's email, its sign-in or its LinkedIn licences confirmed the association. Neither shows who is using the account today. A fake can carry a badge when a real, verified person invents the rest of their history, or when someone else ends up controlling an account its original owner verified. A missing badge proves little. Verifications are optional, "identity verification is limited to select geographies", and the work email route is open only to some companies. The exception is a recruiter or executive title added since September 2025. A missing workplace badge there is worth a question, though not proof, since an unusual title may fall outside the rule. #### Does the work history have depth? Read the profile as a set of claims, the way you would read a resume. LinkedIn's own [guidance on fake profiles](https://www.linkedin.com/help/linkedin/answer/a1338436) points to profiles with little or no information, and to "Job titles that don't make sense, unrealistic career timelines or inconsistent dates." The profiles the Stanford researchers found had patterns in common. Many used titles like business development manager. They often listed two or three former employers, sometimes well-known names, with no details, and none of the companies NPR asked had records of the supposed employees. NPR contacted 28 universities about 57 of the profiles, and of the 21 that responded, none had records of the supposed graduates. Some profiles claimed undergraduate business degrees from schools that do not offer one. So check jobs against the employer, and a degree against the school, starting with whether the school offers that degree at all. Connections count for who they are. A profile [shows "500+"](https://www.linkedin.com/help/linkedin/answer/a549065) once a member has more than 500 connections, so the number says little. LinkedIn's [scam guidance](https://www.linkedin.com/help/linkedin/answer/a1336387) says to pay close attention to profiles that "are not connected to many employees within the company they represent." Mutual connections prove less than they seem, because many people accept invitations from strangers. Activity is the third layer. Posts and comments that other people replied to, spread over years, are hard to produce in a hurry. Endorsements take one click to give, so they count for little either way. #### How to tell if a LinkedIn profile picture is AI-generated By eye, usually you cannot. In a [2022 study in PNAS](https://www.pnas.org/doi/10.1073/pnas.2120481119), Sophie Nightingale and Hany Farid asked 315 people to sort AI-synthesised faces from real ones, and their average accuracy was 48.2 percent, close to chance. With training and feedback after each face, another 219 people reached 59.0 percent, and a third group rated the synthetic faces 7.7 percent more trustworthy than the real ones. Some synthetic faces, the authors suggested, "simply do not contain perceptually detectable artifacts." The tells that circulate come from older generators. DiResta's investigation began with a photo in which the woman wore only one earring, bits of her hair disappeared and reappeared, and her eyes sat right in the middle of the image. That last tell has a cause. A [2023 paper](https://farid.berkeley.edu/downloads/publications/cvpr23b.pdf) by LinkedIn researchers and Farid explains that faces from StyleGAN generators "are aligned in terms of ocular position and interocular distance", and are mostly generated from the neck up, while real profile photos tend to show more of the upper body and shoulders. Newer generators work differently. In the same 2023 paper, a detector trained on StyleGAN faces caught 0.9 percent of Stable Diffusion faces at a 1 percent false positive rate, because the diffusion process "does not rely on the same type of training from aligned faces." A [2024 LinkedIn model](https://www.linkedin.com/blog/engineering/trust-and-safety/finding-ai-generated-deepfake-faces-in-the-wild) trained on several generators caught 98 percent of AI faces from engines it had been trained on, falling to 84.5 percent for engines it had not seen, with its threshold set to wrongly flag 0.5 percent of real photos. A person looking at one photo has far less to go on, so treat a visual tell as a reason to keep checking, never as a finding. A reverse image search is more useful, because its results can be checked. Google's [search by image](https://support.google.com/websearch/answer/1325808) can return "Websites with the image or a similar image", and there are three outcomes: - The photo appears elsewhere under a different name, on pages older than the profile. This is strong evidence that the profile took someone else's photo, the method the FBI describes, and it breaks LinkedIn's [rules](https://www.linkedin.com/legal/professional-community-policies): "Do not use an image of someone else, or any other image that is not your likeness, for your profile photo." If the other pages are newer than the profile, the copying may run the other way, and a different name can still be the same person under a former or transliterated name, so check before concluding. - The photo appears elsewhere under the same name, on pages older than the profile. That supports the profile. - Nothing matches. That fits a generated face and a real person whose photo is not posted anywhere else equally well, so it settles nothing. #### Does the person exist outside LinkedIn? Of the checks you can run without contacting anyone, this one carries the most weight. When the Stanford researchers searched for the personas behind the profiles they had found, Goldstein told NPR, "we didn't find any evidence of them in other places, which is rare." Look for records that someone other than the person wrote, at the time: - The employer's own website: team pages, blog bylines, press releases, and archived copies of those pages from the years the profile claims. - Code. GitHub's API returns [public information about an account](https://docs.github.com/en/rest/users/users#get-a-user), including when it was created, and pull requests merged into real projects show work other people reviewed. - Talks, papers and patents, which carry their own dates and affiliations. - News, conference programmes, alumni announcements, and old forum or social accounts under the same name or handle. - If the person emailed you, the address itself. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) covers what one can show. Common names collide constantly, so a match needs two independent details to line up, such as a name and an employer at the same date. Our guide to [running an OSINT investigation](https://www.sixtyfour.ai/blog/how-to-run-an-osint-investigation) covers keeping those links honest. #### What a real footprint looks like over time A real professional's footprint builds up sideways. A colleague tags them in a team photo one year, a meetup lists them as a speaker another, and an employer's archived team page shows them one year and not the year before. Other people wrote most of it, across years and across services that have nothing to do with each other. A fabricated profile tends to be complete, recent and self-contained, written by its author inside a narrow window. A fake profile can copy a career. It cannot easily copy the years of other people mentioning it. Our guide to [spotting fake candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates) calls this thinness. #### How the checks change with who is asking If you are hiring, the profile is one more claim from the candidate. Check that employers, titles and dates agree with the resume and any public work, and whether the profile existed before this job search. A thin profile is a reason to ask questions. If a recruiter has messaged you, find the company's careers page yourself and read how it says recruiters contact candidates, then check whether the recruiter shows a workplace badge and is connected to colleagues there. The warning signs in the FBI's 2024 alert include offers from prominent technology firms that are unexpected or involve "unrealistically high compensation without negotiation", "Requests to move professional conversations to other messaging platforms", and requests for a "pre-employment test" that means running unknown packages, scripts or GitHub repositories. LinkedIn's scam guidance adds, "Do not provide payment or account credentials as part of the application process." The FBI's advice is to verify a contact "using separate unconnected communication platforms." Recruitment approaches are also used for espionage. In November 2025, the UK's security minister [told Parliament](https://hansard.parliament.uk/commons/2025-11-18/debates/39086819-08E6-4218-A26E-6A3368FC5D9C/ChinaEspionageGovernmentSecurityResponse) that, according to MI5, Chinese intelligence officers were trying to cultivate people with access to sensitive information about Parliament and the government, "often masked through the use of cover companies or external headhunters", and that the National Protective Security Authority would strengthen its engagement with professional networking sites. Job fraud is common in its own right: the FBI's Internet Crime Complaint Center logged [24,688 complaints](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) of employment fraud in 2025, with reported losses of almost $363 million. If a stranger pitches you a product, the persona may be fronting a real company. NPR found that many of the AI-faced profiles seemed to exist to drum up sales, connecting anyone who replied to a real salesperson. Deal with the company through its own website. If you review reported accounts, you often meet LinkedIn profiles linked from a seller's storefront or a contractor's application. Compare the reported profiles with each other for the same few employers, the same headline formula, creation dates in the same weeks and the same style of photo. Our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) covers how much each shared detail is worth. Report the profiles to LinkedIn, and act on your own platform on your own evidence. #### A worked example The people, company and domain below are invented, and halvermoor.example uses a domain name reserved for documentation. An engineer at a fintech gets a LinkedIn message from Mara Ellingsworth, Senior Technical Recruiter at Halvermoor Payments, about a staff role at pay well above the market. After two messages, Mara suggests moving to Telegram, then sends a GitHub repository with a take-home exercise to run on the engineer's laptop. The engineer forwards it all to the security team. The profile. About this member shows it was created in June 2026, with no verifications. LinkedIn said in 2025 that it would ask for workplace verification when a recruiter title is added, so the missing badge is a question worth asking. Three earlier recruiting jobs at well-known companies have one line each. It shows 500+ connections, and the ones the team can see are mostly engineers at fintechs. Its only activity is a few reshared job posts from the past month. The photo. A clean headshot, eyes centred, cropped at the neck. A reverse image search finds no matches, which on its own settles nothing. The company. Halvermoor's careers page says its recruiters write only from halvermoor.example addresses and never ask candidates to install software. Its LinkedIn page lists four recruiters, each with a workplace badge, connected to each other and to dozens of colleagues, and posting Halvermoor's job ads for years. None of them shares a connection with Mara. Outside LinkedIn. The name returns nothing at all. The confirmation. The security team writes to the recruiting address on Halvermoor's careers page, and Halvermoor replies that it has no recruiter by that name. The requests match the FBI's warning signs, so nobody runs the repository. The team warns staff, and the engineer reports the profile to LinkedIn as not a real person. The decision rests on the company's answer and on what Mara asked for. Everything else only told the team where to look. Two questions stay open, and the team's notes say so: whether the photo was generated or taken from someone, and who is behind the account. #### What each check is evidence of | Check | What a strong result shows | What it cannot show | | --- | --- | --- | | Creation date | How long the profile has existed | That the career before it happened | | Identity badge | The profile's name was matched to a government ID a partner checked | That the jobs, schools or photo are real, or who uses the account now | | Workplace badge | The member confirmed an association with that company | The title, the dates or the role | | Connections at the stated employer | People there accepted the connection | That they know the person | | Image match under another name, on older pages | The photo very likely belongs to someone else | Who took it | | No image match | Nothing either way | That the face is generated | | Records others wrote, years old | The person existed and did that work then | That they run this profile today | | The employer, via its own channel | Whether the person works there | Whether this account is theirs | #### What defeats these checks An aged account. A profile opened years ahead and used lightly gets a creation date that looks earned, though the years are on the profile and not around it. A bought or taken-over account. A real account comes with real connections, real history and sometimes a badge its first owner earned. The signs are change: a new photo, headline, location or language on an old profile, often after a long silence. Impersonation of a real person. The photo, the name and often the employer are real, so the outside checks find a real person without proving that they run this profile. Contact the person or their employer through a channel you found yourself, and look for a duplicate of the person's real profile, which LinkedIn lists among its warning signs. A real, verified person with an invented history. The identity badge is genuine, so only the history checks catch it. A face from a newer generator, never posted anywhere, leaves the photo checks silent. These checks raise the cost of a convincing fake without making one impossible. The ones that hold up best go around the profile: the employer's own channel, and records other people wrote. #### Reading the signals fairly Most thin profiles belong to real people. New graduates have short histories, and plenty of professionals joined late, rarely post, or deleted an old account and started again. Verification is optional and not offered everywhere. Some people leave the photo off for privacy, work under a name that differs from the one on their documents, or have a name transliterated differently in different countries. Agency recruiters and contractors may not be connected to the staff of the companies they work with. And a real person may have used an AI tool to make a headshot of themselves, which is still their likeness. So keep three levels apart. Thin means look further. A contradiction, such as an employer or school with no record, a photo under someone else's name, or a company that denies the person, calls for an explanation. A confirmation through a channel you found yourself settles the question. If the profile belongs to a candidate or a customer, ask them about what does not fit before deciding anything. #### How to report a fake LinkedIn profile On desktop, open the profile, click More, then Report / Block, and select Report [name] or entire account. Select This person is impersonating someone or This account is not a real person, then submit the report. LinkedIn says reported members ["won't know who made the report."](https://www.linkedin.com/help/linkedin/answer/a1338436) If the profile is impersonating someone you know, tell them through a channel you already have. #### Where Sixtyfour fits Checking a profile by hand means working through company pages, archives, code, talks and news, and noting where every finding came from. Sixtyfour's agent starts from what you already have, such as a name, an email address or a known profile, researches public sources, and links what it finds to the same person. Every finding comes with its source, and anything it could not establish is reported as open rather than filled in. A person on your team decides what to ask and what to do next. There is more on how hiring teams use it on our [workforce identity page](https://www.sixtyfour.ai/solutions/workforce-identity), and on how platform teams use it on our [trust and safety page](https://www.sixtyfour.ai/solutions/trust-and-safety). #### The short version Check when the profile was created and what its verifications actually prove, read the work history for details that can be checked, and search the photo. Then look for the person outside LinkedIn, in records other people wrote over the years, and confirm anything that matters through a channel you found yourself. --- ### The new Sixtyfour search, tested on Exa's own benchmarks *Sixtyfour search now puts a match first on 90.4% of the queries in Exa's people search benchmark, ahead of every published result.* Source: https://www.sixtyfour.ai/blog/people-and-company-search-benchmark Yahia Salman · 2026-10-13 · Product We rebuilt how Sixtyfour search finds people and companies. On Exa's open people search benchmark, our first result now matches the search on 90.4% of queries. Exa publishes 72.0% for its own search. Figure: people-and-company-search-benchmark-overview.jpg | Bar charts of precision and R@1 on Exa's people and company search benchmarks. Sixtyfour leads every chart: people precision 82.8%, people R@1 90.4%, company precision 79.6% and company R@1 86.4%. | Sixtyfour against the results Exa publishes for Exa, Brave and Parallel, and the figure Juicebox reported. #### What changed You can describe the people or companies you want in plain English, the way you would brief a colleague. Several agents work on that request together, each writing part of the filters the search runs on. A reranking model then reads the results and judges how well each one fits what you asked for. The strongest fits move to the top of your list, and results that clearly don't fit are dropped. You spend less time skipping past people in the wrong role or the wrong city. This applies to natural-language people and company searches in the Sixtyfour app, the API and the MCP server. #### The results Exa released its [people search](https://exa.ai/blog/people-search-benchmark) and [company search](https://exa.ai/blog/company-search-benchmarks) benchmarks with the queries, the grading prompts and an evaluation harness in an [open source repository](https://github.com/exa-labs/benchmarks), so anyone can run them against their own search. The people benchmark has 1,400 queries like "director of marketing based in california senior level", and the company benchmark's retrieval track has 605. An LLM judge reads each result and decides whether it fits the query. Figure: people-and-company-search-benchmark-scores.jpg | Table of Sixtyfour against Exa on all six measures, with Sixtyfour's lead in points. People search: R@1 90.4% against 72.0%, R@10 96.6% against 94.5%, precision 82.8% against 63.3%. Company search: R@1 86.4% against 61.8%, R@10 94.4% against 94.2%, precision 79.6% against 65.9%. | Sixtyfour against the results Exa publishes for its own search, on every measure of both benchmarks. Sixtyfour reaches 82.8% precision on the people search benchmark, ahead of Juicebox (79%), Exa (63.3%), Brave (30.2%) and Parallel (26.9%).* Precision is the average share of returned results that are relevant. R@1 measures how often the top result is relevant, and R@10 how often at least one relevant result appears in the top ten. We graded with Exa's prompts unchanged, using GPT-5.4, the default in Exa's benchmark scripts until September 2026. You can try the new search in the Sixtyfour app or through the API, and the queries and grading are public if you want to check these numbers yourself. *Exa, Brave and Parallel: the results Exa publishes in its repository. Juicebox: its own reported figure. --- ### How to run an OSINT investigation *One case from the first question to the written report: how to scope it, pivot between identifiers, weigh each link, preserve the evidence and say how sure you are.* Source: https://www.sixtyfour.ai/blog/how-to-run-an-osint-investigation Saarth Shah · 2026-10-07 · Trust & Safety To run an OSINT investigation, start with a question you can answer and a written scope, list the identifiers you already hold, and pivot from each one while logging every search. Weigh each link by how rare the shared value is and whether it is independent of your other links, corroborate and date every finding, and save each source with its address, a timestamped capture and a hash. Stop when the question is answered, and write each finding with a stated likelihood and the evidence behind it. Keep the work passive throughout: read what is public, and never contact the subject. This guide follows one invented case from the first question to the write-up. Our guides to [email addresses](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address), [phone numbers](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number), [related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) and [website ownership](https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website) go deeper on the individual pivots. #### Start an OSINT investigation with a question you can answer A marketplace's trust and safety team receives nine non-delivery complaints in ten days about a new seller, Fenwray Optics, which lists camera lenses well below market price. Someone on the team thinks it looks like quillaperture, a lens seller banned in May for the same pattern. The two accounts share no phone number, email address, device or payout account on the platform, so the account records alone cannot answer it. "Find out everything about Fenwray Optics" has no end point, and it sends the analyst after every person the shop has touched. A workable question names what you want to know and the decision it serves. Here: is Fenwray Optics run by the same operator as quillaperture? If it is, the team treats the shop as ban evasion and holds its payouts. Write the scope down beside the question. The Berkeley Protocol on Digital Open Source Investigations, first published in 2020 by the UN human rights office and the Human Rights Center at UC Berkeley's law school, asks for an [online investigation plan](https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf) before the searching starts, setting out the objectives, priorities, strategy and a timeline. In this case the scope covers both shops' identifiers. The buyers who complained, the operator's family and anything that would need contact with the seller are out. The time box is one afternoon. Then list what you hold, and where each item came from: | Identifier | Source | First pivot | | --- | --- | --- | | Shop name and handle, fenwray_optics | Seller profile | The same strings elsewhere | | Email, fenwray.optics@example.com | Account record, verified at signup | Breach history and attached accounts | | Phone, +1 614 555 0172 | Account record and shop page | Ads, listings and directories | | Website, fenwrayoptics.example | Shop description | Registration date and archived copies | | quillaperture's handle, email and phone | The banned account | The same searches, for comparison | Note which items the platform verified. A verified email or phone number was in the operator's hands on the day of signup. A shop name or a founder's name on an About page is whatever the operator chose to type. #### Pivot from each identifier, and keep a log A pivot uses one identifier to find the next. Work through them one at a time and log every step as you go: the time, what you searched, where, what came back and what you did with it, dead ends included. The Berkeley Protocol describes an investigation as a cycle of inquiry, assessment, collection, preservation, verification and analysis that may be repeated many times as new information opens new lines of inquiry, and it asks investigators to document their activities in every phase. The log is what lets a colleague repeat your path, and it keeps the same search from being run three times. In the case, four pivots matter. - The website. Its registration record shows it was created in August 2026, and its earliest copy in a public web archive is from September. Its About page says the business has traded since 2009. - The email address. No breach history and no trace before September, which fits a new address. - The handle. fenwray_optics appears nowhere else. - The phone number. It appears in a classified ad from March 2024 for a used telephoto lens, which gives a contact address of quillaperture@example.net. That last pivot is the lead. The rest of the method is about how much weight it can bear. #### How strong is a link? Three questions decide it. How rare is the shared value? A link is worth more the fewer people could share it by chance. The string quillaperture has been used by one account on the platform, and the 2024 ad is the only other place it turns up. A shared city or a common first name would be worth almost nothing. Our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts) sets out how to weigh a shared value by the number of accounts that have it. Is it independent of the other links? Two links that come from one fact count once. The shop page and the website list the same phone number because the operator typed it into both. That is a single link. Is it the same person, or only the same name? The website's About page names a founder, Theo Halvessy. A search finds a Theo Halvessy who works as a wedding photographer in another state, with a portfolio going back years. It is the same unusual name in a neighbouring field, and nothing else connects them: no shared phone number, email address, handle or image, and his own site lists a different number. Operators can put anyone's name on a page, including a real person's. He stays out of the case, and the team collects nothing more about him. Then try to break each link. Ask what would make it wrong. Here the answer is that the phone number could have passed to someone else between 2024 and 2026. Doing this on purpose matters. A [2026 study of confirmation bias in police investigations](https://journals.plos.org/plosone/article?id=10.1371%2Fjournal.pone.0327036) cites an earlier experiment in which participants told explicitly to try to falsify their first hypothesis showed less confirmation bias, while participants who only generated alternative hypotheses did not. #### Corroborate and date every finding A finding is corroborated when a second source supports it without having taken the fact from the first. Trace each fact to where it first appeared. The Berkeley Protocol calls this provenance, and suggests describing the earliest version you find as the "first copy found online", because the original may have been removed. Two articles quoting one press release are one source, and so are two profiles the operator filled in themselves. In the case, the second source comes from the platform's own listings. A quillaperture listing from April includes a photograph of a lens with its serial number visible on the barrel. A Fenwray listing from September shows the same serial number, in a different photograph against a different background. That link does not depend on the phone number at all. A resale could explain it, so it supports the conclusion rather than settling it alone. Then date every finding twice: when the thing happened, and when you saw it. Identifiers change hands and pages are edited, so an old record may describe someone else. The Berkeley Protocol notes that texts written at the time of the events they describe tend to be treated as more reliable than those produced long after. Dated, the case becomes a sequence: the ad in March 2024, quillaperture's listings from January to May 2026, the ban in May, the domain registered in August, the first Fenwray listing in September. The phone number appears under no other name anywhere in that period. That does not prove it never changed hands, and the report will say so. #### Preserve your sources so others can check the work Pages disappear. A [Pew Research Center analysis](https://www.pewresearch.org/data-labs/2024/05/17/when-online-content-disappears/) found that a quarter of the webpages that existed at some point between 2013 and 2023 were no longer accessible by October 2023, and that 38 percent of pages from 2013 were gone. An old classified ad is exactly the kind of page that expires. For each page a finding rests on, keep: - its URL; - a full-page capture that shows the date and time; - the page's HTML source; - a hash of every saved file, using an algorithm from the [Secure Hash Standard](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf) such as SHA-256, so anyone can later confirm the file has not changed; - a log entry saying who captured it and when. That list follows the collection guidance in the Berkeley Protocol. A screenshot on its own is weak evidence. As a [guide to archiving](https://www.bellingcat.com/resources/how-tos/2018/02/22/archive-open-source-materials/) from the investigative newsroom Bellingcat puts it, "Screenshots can be easily forged." A public archive copy helps. The Internet Archive's [Save Page Now](https://help.archive.org/help/save-pages-in-the-wayback-machine/) gives a permanent URL for a single page. Public copies are open to anyone with the address, though, so keep your own copy as well. #### When to stop Stop when the question has an answer at the confidence the decision needs. The leads will not run out on their own. Three signs tell you that you are there: the next pivots return what you already have, the next pivot leads outside the scope, or the time box is spent. In the case, the team has two independent links and a dated sequence. The remaining leads point at the photographer and at the operator's real-world identity. Neither is needed to answer the question, and following them would mostly mean collecting information about people outside it. The Berkeley Protocol's principle of data minimisation says online content should only be collected if it is relevant to a particular investigation. So the team stops, and records what it did not establish as open. #### Write the findings with stated confidence Readers take the same words to mean very different odds. In a [1964 essay](https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf) published by the CIA, Sherman Kent recalled a 1951 intelligence estimate that called an attack on Yugoslavia that year a "serious possibility". Kent meant odds of about 65 to 35 in favour of an attack. The State Department officials reading it had taken it to mean much lower odds, and when Kent asked the colleagues who had agreed the wording, their answers ran from about 20 to 80 up to 80 to 20. A fixed scale is meant to close that gap. The US intelligence community's analytic standards, [ICD 203](https://archive.dni.gov/files/documents/ICD/ICD-203.pdf), tie each likelihood word to a range, so that "likely" means 55 to 80 percent and "very likely" means 80 to 95 percent. They also ask analysts to keep the likelihood of a judgement separate from their confidence in its basis, to separate the underlying information from assumptions and judgements, and to name what would change the judgement. They were written for intelligence analysts, and the habits suit any team writing for someone who has to decide. The case's findings, written that way: - Fenwray Optics is very likely (80 to 95 percent) run by the same operator as quillaperture. This rests on two independent links: the shop's phone number appears in a March 2024 ad that uses quillaperture's handle, and listings from both shops show a lens with the same serial number. Our confidence is moderate, because the phone link assumes the number did not change hands between 2024 and 2026. A record of another holder in that period would lower the likelihood. - The website's claim to have traded since 2009 is not supported by any record found. The website was registered in August 2026, and its earliest archived copy is from September 2026. - Open: who the operator is. The About page names a founder, and the one person found with that name has no connection to either shop in any record reviewed. Every sentence points to a logged and preserved source, so a reviewer can check each one before the team acts. #### Working passively and fairly Open-source research reads what is already public. The Berkeley Protocol draws the line at contact: information acquired from internet users by communicating with them counts as closed source. In practice that means no messages to the seller, no follow requests, no password reset forms and no test logins. Contact also tells the operator someone is looking, which can lead them to delete the accounts you were about to find. Do not deceive people to get information. The Protocol warns that misrepresentation can damage an investigation's credibility and contaminate the information collected. Watch your own footprint. Some platforms tell people who looked at them: depending on the viewer's privacy settings, [LinkedIn shows](https://www.linkedin.com/help/linkedin/answer/a568195) a profile's owner the viewer's name, headline, location and industry. Check those settings before you start. Collect as little about other people as the question allows. Every investigation passes bystanders: the photographer who shares a name, the buyers, the previous holder of a phone number. The Berkeley Protocol lists bystanders among the people an investigation may need to protect. Leave them out of the record unless the question needs them. #### Reading the results fairly A finding is only as good as the record behind it, and the record is uneven. Quiet is normal. New identifiers, careful people and people who rarely post all leave thin trails. When a search comes back empty, try another identifier before reading anything into the silence. Identifiers change hands. Phone numbers are recycled, domains lapse and are registered again, and accounts are sold. Dates are what separate one holder from the next. Names are claims. Anyone can put a name on a page, so a name match needs an identifier match behind it. Some people are harder to find than others. The Berkeley Protocol notes that online information may be unevenly available from certain groups or segments of society, so a thin result may describe the record more than the person. And "very likely" leaves a real chance of being wrong. That is why a person reviews the evidence before anyone acts on it. #### Where Sixtyfour fits Much of this method is collection: running each identifier across many sources, following it to the next one, and keeping a source for every fact. Sixtyfour's agent does that part. It starts from an identifier, such as an email address, phone number, username, name or company, researches public sources, links the findings that belong to the same person or company, and returns every finding with its source. Anything it could not establish is reported as open. The results go to your team, and a person decides what happens next. There is more on how investigation teams use it on our [investigations page](https://www.sixtyfour.ai/solutions/investigations). #### The short version Write down a question you can answer and its scope, list the identifiers you hold, and pivot from each one with a log. Count a link only when the shared value is rare and independent of your other links, try to break it, then corroborate and date every finding and preserve each source with a capture and a hash. Stop when the question is answered, and write each finding with a stated likelihood, the evidence behind it, and what is still open. --- ### How to find out who owns a website *Most registration records now hide the owner. The pivots that still work, what each one is evidence of, and how to tell today's operator from a domain's earlier owners.* Source: https://www.sixtyfour.ai/blog/how-to-find-out-who-owns-a-website Hashim Khawaja · 2026-10-06 · Trust & Safety To find out who owns a website, look up its registration record through RDAP, which replaced WHOIS as the source of registration data for generic domains in January 2025. Then follow the pivots that survive redaction: the site's DNS and hosting, the certificates issued for it, its archived history, the identifiers on its pages and the business it claims to be. The registrant's name is usually hidden, so ownership has to be pieced together from several of these, each with a date attached, and the person running the site today may not be the one behind its oldest traces. #### What you can find out about who owns a website A website has several owners. The registrant holds the domain, bought from a registrar. A hosting company runs the servers. And an operator, who may be none of these, decides what the pages say and where the money goes. In a scam storefront or a phishing site you want the operator, and you can contact the registrar and the host. Few pivots name the operator directly. They show which other sites the same operator runs, and an operator careful on one site may be careless on another. In a [2018 study of analytics IDs on malicious websites](https://www.securitee.org/files/malanalytics_www2018.pdf), researchers identified 59 operators of malicious sites by finding public registration records for other domains that shared the same analytics IDs. Domains also lapse and change hands. So, as with a [phone number](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number), every finding needs a date, and every link to a person needs a second source. #### Question one: what does the registration record say? Since 28 January 2025, ICANN has treated RDAP, the Registration Data Access Protocol, as [the definitive source](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) of registration data for generic top-level domains such as .com, in place of WHOIS. ICANN's [Lookup tool](https://lookup.icann.org/en) queries it. Under ICANN's [Registration Data Policy](https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy), every generic-domain record publishes the creation and expiry dates, the registrar and its abuse email address and phone number, the status codes and the name servers. It may also show the [last transfer](https://itp.cdn.icann.org/en/files/registry-operators/rdap-response-profile-21feb24-en.pdf), meaning a change of registrar, not necessarily of owner. Of the [status codes](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en), clientTransferProhibited is a lock that helps prevent hijacking, clientHold and serverHold mean the domain will not resolve, and redemptionPeriod and pendingDelete mean it is being deleted. The registrant is another matter. In May 2018 ICANN adopted a [temporary specification](https://www.icann.org/resources/pages/gtld-registration-data-specs-en) that restricted most personal data to "layered/tiered access", and registrars began replacing registrants' details with text such as "REDACTED FOR PRIVACY". Where redaction applies, the policy that replaced it on 21 August 2025 withholds the registrant's name, street, postal code and phone numbers, optionally the city, and swaps the email address for a relay address or a web form. It still publishes the registrant's country, the state or province where one was collected, and the organisation name if the registrant agreed. A privacy or proxy service shows its own details instead of its customer's. Country-code domains such as .uk follow [rules set within each country](https://www.icann.org/resources/pages/cctld-2012-02-25-en), so use that registry's own service. To ask for the redacted data on a generic domain, use ICANN's free [Registration Data Request Service](https://www.icann.org/rdrs-en), which needs an ICANN account and is meant for requesters such as consumer protection advocates and cybersecurity specialists. Registrars take part voluntarily, country-code domains are not covered, and [the registrar decides](https://www.icann.org/rdrs-requestors-faqs-en.pdf) whether to disclose anything. ICANN says the service [does not guarantee access](https://www.icann.org/resources/press-material/release-2023-11-28-en). Otherwise, use the registrar's own disclosure process. Expect delay or refusal, and keep working the other pivots. #### Question two: how old is the site, and has it changed hands? A registration date marks the start of the current registration, which is not always the start of the site's history. When a lapsed domain is deleted, the registry holds it for 30 days, and five days after that, [ICANN's guide](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) says, it is purged and "becomes available for registration". The next registrant gets a new creation date, and the authors of a [2017 study of re-registration](https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-lauinger.pdf) detected re-registrations exactly that way. Every day, they wrote, hundreds of thousands of domains are abandoned, and about 10 percent of deleted .com domains were registered again the same day. The new holder inherits the domain's reputation, which [researchers call residual trust](https://astrolavos.gatech.edu/articles/domain-z-ieee.pdf), and adversaries do exploit it. A domain that is sold keeps its original creation date instead, and the 2017 study found that expired domains sold before deletion show "only very limited cues as to the new ownership". So read the creation date against the site's history. A recent date on a domain with years of history means it lapsed and was registered again. An old date with an abrupt change in what the site does may mean a sale. Two public records supply that history. The Internet Archive's Wayback Machine shows the site on each date it was captured, including old contact and about pages. Its help centre explains how to [list everything archived for a domain](https://help.archive.org/help/using-the-wayback-machine/). Gaps prove little, because the Archive misses sites its crawlers did not know about, sites that blocked them, and sites whose owners asked to be excluded. Certificate transparency logs, first specified in [RFC 6962](https://www.rfc-editor.org/rfc/rfc6962), are public and append-only, and [anyone can query them](https://certificate.transparency.dev/howctworks/) "to see what certificates have been included and when". In versions of Chrome that [enforce certificate transparency](https://googlechrome.github.io/CertificateTransparency/ct_policy.html), a publicly trusted certificate that has not been logged fails to validate, so an ordinary HTTPS site leaves a trail. A free search such as [crt.sh](https://crt.sh/) lists each certificate's dates and names, which often reveals subdomains and shows when the site took its current form. A certificate can date a site without naming its owner: Let's Encrypt [offers only domain-validated certificates](https://letsencrypt.org/docs/faq/), which under the [CA/Browser Forum's rules](https://cabforum.org/2015/09/28/ballot-151-addition-of-optional-oids-for-indicating-level-of-validation/) carry no organisation name. #### Question three: where is it hosted? DNS records show the infrastructure behind the name ([RFC 1035](https://www.rfc-editor.org/rfc/rfc1035), [RFC 3596](https://www.rfc-editor.org/rfc/rfc3596)). A and AAAA records give the server's addresses, NS records the name servers, MX records the mail servers and TXT records free text. That text often includes an SPF record ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208)) authorising the hosts that may send the domain's mail, which can name the operator's mail services. An RDAP lookup on the server's IP address returns the network's registration and its abuse contact, which, as the RIPE NCC [warns](https://www.ripe.net/about-us/support/abuse/), "will be an ISP or other network operator - not the abuser". That is where takedown reports go. A shared IP address is weak evidence. A [study published in 2020](https://arxiv.org/abs/2004.04623) found more than 60 percent of websites co-located with at least ten others. Count the domains on an address before reading anything into it, as in [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts): a handful can be a lead, two thousand is background. Behind a security proxy or content delivery network, as one [measurement study](https://www.securitee.org/files/cloudpiercer_ccs2015.pdf) put it, "the origin's IP address is no longer listed in the DNS records of the domain name", so the address you see is the provider's. Parked domains use a parking service's name servers, and a [2015 study](https://www.securitee.org/files/parking-sensors_ndss2015.pdf) counted more than 8 million of them, so shared parking says nothing about ownership. #### Question four: what links it to other sites? Certificates. One certificate can cover several names, as [Let's Encrypt's FAQ](https://letsencrypt.org/docs/faq/) notes. Two unrelated-looking domains on one certificate were requested together, either by one owner or by a hosting provider that puts [domain names from numerous distinct customers](https://arxiv.org/abs/1906.10775) on a shared certificate. Analytics IDs. The 2018 study found that shared analytics IDs cluster sites "managed by the same person/team", even on different servers and behind registration privacy, and that such sharing is "very common across both benign and malicious website owners". In an old Universal Analytics ID such as UA-123456789-1, [the centre number identifies the account](https://www.bellingcat.com/resources/2024/01/09/using-the-wayback-machine-and-google-analytics-to-uncover-disinformation-networks/). Google [stopped processing](https://support.google.com/analytics/answer/11583528?hl=en) standard Universal Analytics data in July 2023, and Bellingcat calls the replacement IDs "less uniform", but old ones survive in archived copies of a site. Two cautions from the same study: a phishing page cloned from a real site often carries the victim's ID, because the cloning software copies the analytics code, and hosting companies' pages for suspended accounts can share one ID across many domains. Verification tokens. Services ask site owners to publish a token, in a TXT record or a meta tag, to prove control. Google describes its Search Console tag as "[tied to a specific user](https://support.google.com/webmasters/answer/9008080?hl=en)", and its verification API issues [a different token for each site](https://developers.google.com/site-verification/v1/getting_started). An [IETF draft on domain verification](https://datatracker.ietf.org/doc/draft-ietf-dnsop-domain-verification-techniques/) describes tokens that identify either the challenge or the user. The same token on two domains points to one account or to a record copied between them, and either is a link. A cloned page carries its meta tags with it, while a TXT record stays behind. Contact and payment details. Phone numbers, email addresses, messaging handles and the account buyers pay into. Our guides to an [email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) and a phone number cover what each can prove. Payment details from victims' reports are among the strongest links, because the money has to reach someone. | Shared value | What a match suggests | How it misleads | Starting weight | | --- | --- | --- | --- | | Receiving bank account or wallet | One operation collects the money | The named holder may not be the operator | Strong | | Analytics account | One person or team manages both sites | Cloned pages, and agencies with many clients | Strong once cloning is ruled out | | Verification token | One account, or a copied record | Cloned meta tags | Medium to strong | | Contact phone or email | One operator answers both sites | Copied templates, recycled numbers | Medium to strong | | Certificate | Names requested together | Shared hosting certificates | Medium | | Name servers or IP address | The same provider or server | Shared hosting, content delivery networks, parking | Weak unless few sites share it | Count only independent links: an analytics account and a token set up in one sitting are nearly one observation. #### Question five: who does the site claim to be? Check any company, address or registration number named in the footer, terms, contact or imprint pages against the registry of the country named. In the UK, Companies House gives [free details](https://www.gov.uk/get-information-about-a-company) of any company, including its registered address, date of incorporation, current and resigned officers and previous names. Look for an incorporation date years after the site's claimed founding, or a registration number that belongs to a differently named company. That company's details were probably borrowed, and it belongs in the report as an affected party. #### A worked example The case below is a composite. Its domains use the [.example names](https://www.rfc-editor.org/rfc/rfc2606) reserved for documentation, its IP address comes from a [range reserved for examples](https://www.rfc-editor.org/rfc/rfc5737), and its phone number from the 555-0100 to 555-0199 range reserved for fiction. In late September 2026, a marketplace's trust and safety team receives reports from four buyers. Each saw a well-known outdoor brand's jackets at half price from one of three seller accounts opened that month, was told to order "direct from our outlet" at brindlecote.example, paid by bank transfer and received nothing. The registration. RDAP shows a registration on 11 September 2026 through a large retail registrar, with a privacy service in place of the registrant. The site's about page says it has served customers since 2011. The history. The Wayback Machine shows a small homewares shop on the domain from 2012 to 2021, then a for-sale parking page, then the storefront from mid-September 2026. The certificate logs agree: yearly certificates for the shop until 2021, then a new one on 12 September 2026, covering a checkout subdomain too. The domain lapsed and was registered again, so "since 2011" borrows the shop's history, and the domain's earlier holders are filed as previous registrants and nothing more. The hosting. The site resolves to 203.0.113.42, shared with about 1,900 other domains, so the address is set aside. The fingerprints. The page carries two analytics tags. One is the brand's own, copied when the storefront was cloned, so it links the scam only to its victim. The other appears on one other site, jacket-clearance.example, a storefront copying a different brand, registered in August 2026. The two domains publish the same verification token in their TXT records, and both contact pages give the same WhatsApp number, +1 312 555 0164. The money. Two buyers had already reported jacket-clearance.example to the marketplace, and the bank details they were given match the brindlecote.example buyers'. The business. Companies House shows that the UK company number in the footer belongs to an unrelated dormant company, which is filed as an affected party. Put together, the storefronts are one operation. The analytics account and the token may come from one set-up session, so they count as one strand, and the contact number and the bank account are independent of it and of each other. The team acts on the three seller accounts, archives the storefronts, reports both domains to their registrars' and hosts' abuse contacts and to Google Safe Browsing, and files a disclosure request with the registrar. Who the operator is stays open: the registrant is behind a privacy service, the request may go unanswered, and the account holder's identity sits with the bank. The report says so. #### Investigating without alerting the operator Most pivots above are read from third parties. Visiting the site is different, because its server can log every request. When you need to see it, use an isolated browser, and do not log in, fill in forms, start a checkout or enter any details. Take payment details from victims' reports, never from a test order. Preserve evidence with screenshots and the Archive's Save Page Now, which saves [one page at a time](https://help.archive.org/help/using-the-wayback-machine/). Report through abuse contacts and [Safe Browsing](https://developers.google.com/search/help/report-quality-issues), never to the operator. #### Reading the results fairly Most of what makes a website look suspicious has an ordinary explanation, and a fair report checks for it first. A hidden registrant is normal. Registrars have redacted personal data since 2018, and before that an ICANN-commissioned study found privacy or proxy services on about [20 percent of domains](https://www.icann.org/en/blogs/details/results-of-the-gnso-whois-privacyproxy-abuse-study-17-9-2013-en) in the top five generic top-level domains. A [later study for ICANN](https://www.cl.cam.ac.uk/~rnc1/whoisstudy.pdf) found them more often on domains used for harm, but also on 28 percent of the legitimate banks it examined. A young domain is normal for a new business, and a domain with someone else's history may have been bought in good faith. Shared hosting, content delivery networks and parking services put strangers on one address. Previous owners in archives and old certificates are earlier holders and nothing more. A cloned page's analytics ID and meta tags point to the brand it copied. Agencies and freelance developers build many clients' sites, so a shared analytics account can mean a shared developer. And a company named on a site may never have heard of it. #### Where Sixtyfour fits Run carefully, the five questions take time, and much of what they produce is a set of identifiers: email addresses, phone numbers, usernames and company names. Sixtyfour's agent starts from identifiers like these, researches where each one appears across public sources, links what it finds to one person or entity, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides what happens next. There is more on how trust and safety teams use it on our [trust and safety page](https://www.sixtyfour.ai/solutions/trust-and-safety). #### The short version Read the registration record, date the site through its archive and certificates, find where it is hosted, and search for the accounts, tokens, contact details and payment details it shares with other sites. Give every finding a date and a weight, count only independent links, and mark what you could not establish as open. --- ### How to verify a resume: employment history, degrees and licences *Job seekers stretch claims more often than they invent them. How to check each claim against a record the candidate did not write, and what a mismatch can mean.* Source: https://www.sixtyfour.ai/blog/how-to-verify-a-resume Julian Wong · 2026-10-06 · Trust & Safety To verify a resume, treat it as a list of separate claims and check each one against a record the candidate did not write: the registrar for a degree, the issuing board's register for a licence, company registries and archived copies of the employer's own website for a job, and the project's own history for open-source work. Confirm anything that is not public, such as employment dates or a transcript, with the employer or school directly and with the candidate's consent. Then mark each claim as confirmed, explained or open, and ask the candidate about anything that does not line up. This guide assumes the person is real and asks whether their claims hold up. Whether the person behind an application is who they say they are is a separate question, covered in our guide to [spotting fake candidates before the interview](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates). #### How to verify a resume, one claim at a time Job seekers stretch claims more often than they invent them. Christine Henle, Brian Dineen and Michelle Duffy ran three anonymous surveys, two of US business students and one of working adults who had recently found a job. On average, 72 percent said they had embellished their resume in their current or most recent job search to at least some extent, 61 percent had left relevant information out, and 31 percent had fabricated information ([Journal of Business and Psychology, 2019](https://doi.org/10.1007/s10869-017-9527-4)). The authors define fabrication as intentionally falsifying information, such as listing a degree never earned, and embellishment as exaggerating otherwise accurate information, such as overstating involvement in a project. The same paper notes that checking only one kind of claim, such as degrees, leaves the rest undetected, and that some claims, such as how involved someone was in a project, may be hard to confirm. So start by writing the resume out as claims. "Senior engineer, Quillmere Data, 2019 to 2022" is three of them: an employer, a title and a pair of dates. Each can hold up while another does not. | Claim | Who can confirm it | Public trace to look for | | --- | --- | --- | | Employer and dates | The employer, with the candidate's consent | Company registry, archived team pages, bylines and conference bios | | Job title | The employer | Archived team pages, talk and paper bios | | Degree | The school's registrar | The school's accreditation, though not the degree itself | | Professional licence | The board that issued it | The board's public lookup | | Certification | The issuer, from a credential ID or badge link | Often nothing you can search by name | | Open-source work | The project | Reviewed pull requests, the maintainers list | | Talks, papers, patents | The organiser, publisher or patent office | The programme, the paper, the patent record | | Scope ("led", "owned", "grew") | Colleagues and references | Rarely anything | Put most of the effort where fabrication is possible: employers, titles, dates, degrees and licences. Scope claims matter too, but interviews and references test them better than records do. #### Which claims leave a public footprint Weigh every record by who wrote it and when. A conference programme from 2021 that lists someone with their employer was written by the organisers at the time. A blog post the candidate published in 2019 was written by them, but before this application existed. A profile updated last month was written by the candidate for this job search, and counts for least. The size of the employer changes what you can find. A role at a company of thousands rarely shows on the company's own website, so any trace is the person's own: a talk, the affiliation line on a paper, a profile kept for years. A 30-person startup is often the opposite. Its team page may have listed everyone, it may since have closed or been acquired, and archived copies of its site may be the best record left. Open-source work can leave a detailed trace, and it needs careful reading. GitHub [places a commit on a profile](https://docs.github.com/en/account-and-profile/reference/profile-contributions-reference) by its author date, and Git lets whoever makes a commit [override that date](https://git-scm.com/docs/git-commit). A profile's graph can also include private contributions, shown as daily counts with no detail. So treat the graph as a summary. The stronger evidence is inside the project: pull requests that other maintainers reviewed and merged, and the commit that added the person to the maintainers list. Talks, papers and patents carry their own dates and affiliations. Check the conference's own programme and the paper itself. US patents can be searched by inventor in the [USPTO's Patent Public Search](https://www.uspto.gov/patents/search/patent-public-search), which from 7 November 2026 can only be used while signed in to a USPTO account. #### How to verify degrees, licences and certifications Start by checking that the school is real and accredited. The US Department of Education's [Database of Accredited Postsecondary Institutions and Programs](https://ope.ed.gov/dapip/) (DAPIP) holds information reported by recognised accrediting agencies and state approval agencies. The Department notes that this information is not audited, and that institutions outside the United States are not included. The Council for Higher Education Accreditation (CHEA) keeps its own [database of accredited institutions and programmes](https://www.chea.org/directories), plus an international directory of more than 500 quality assurance bodies, accreditation bodies and ministries of education around the world, which is where to start with a degree from abroad. Accreditation can be faked too. The FTC warns that some fake degree programmes [make up an accreditor or lie about being accredited](https://consumer.ftc.gov/articles/college-degree-scams) by a real one, and that some diploma mills use names very close to those of well-known universities. Then confirm the degree with the school. The FTC's guide for employers says most registrars will [confirm dates of attendance and graduation](https://www.ftc.gov/business-guidance/resources/avoid-fake-degree-burns-researching-academic-credentials), degrees awarded and majors, and that with the applicant's permission they may provide a certified transcript. Find the registrar through the school's own website, because the same guide notes that some diploma mills offer a "verification service" that sends a fake transcript to employers who call. US colleges can hand degree verification to the [National Student Clearinghouse](https://www.studentclearinghouse.org/about/), a nonprofit founded by the higher education community, which answers from the records schools send it and [puts its coverage](https://www.studentclearinghouse.org/solutions/ed-verifications/) at 96 percent of US four-year degrees. Licences are issued by boards, and boards often publish a lookup. California's engineering board, for example, [points anyone checking a licence](https://bpelsg.ca.gov/about_us/contact.shtml) to the lookup on its website. CPAs can be checked in [CPAverify](https://nasba.org/blog/2026/03/12/all-about-cpaverify/), a free search hosted by the National Association of State Boards of Accountancy with data sent by the state boards (53 jurisdictions took part as of March 2026). Check the name, the status, and that the licence covers the state and discipline the resume claims. Certifications often cannot be looked up by name. AWS, for example, [does not provide a list](https://aws.amazon.com/certification/faqs/) of certified people, and asks anyone verifying a certification to request the holder's digital badge link. Ask for the credential ID or link, and check it through the verification route the issuer gives. #### How to verify employment history Work through five questions, in this order. Did the employer exist at the time? Company registries date it. Delaware's free entity search gives an [incorporation or formation date](https://icis.corp.delaware.gov/ecorp/entitysearch/NameSearch.aspx), and the UK's Companies House shows the [date of incorporation and previous company names](https://www.gov.uk/get-information-about-a-company) free of charge. A company incorporated after the claimed start date needs an explanation, and there may be an ordinary one, such as a founding team that worked together before it incorporated. Was the person there? The employer's own website from the time is the best public witness, and the Internet Archive keeps old copies. Its help centre explains how to [list everything archived from a site](https://help.archive.org/help/using-the-wayback-machine/), which turns up old team, about and blog pages. The archive is incomplete and says so: some sites are missing because its crawlers did not know they existed. Its Save Page Now feature also lets anyone save a page, so a capture of a page the candidate controls shows that the page existed on that date, and nothing more. Who else recorded it? Conference programmes, papers with affiliation lines, press releases and engineering blog posts with bylines all name people and employers at a date, and someone other than the candidate wrote them. What did the candidate say at the time? A profile kept for years, especially one archived along the way, shows what they said about a job while they held it. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) covers finding the accounts behind one identifier. What does the employer say? Dates and title come from the employer, through contact details you find yourself, once the candidate has agreed to the check. #### A worked example The candidate, companies and project in this example are invented. Tamsin Arlecourt applies for a remote senior backend role. Her resume claims: 1. Staff engineer at a large payments company, September 2022 to now, where she "led the migration of the settlement ledger to a new database". 2. Senior engineer at Quillmere Data, a 30-person analytics startup, January 2019 to August 2022. 3. A master's in computer science, completed online in 2018 at a US state university. 4. Maintainer of an open-source database migration library since 2021. 5. A talk at a regional engineering conference in 2021. The degree. The university is listed in DAPIP with a recognised accreditor, and with Tamsin's consent the registrar confirms the master's and its 2018 date. Confirmed. The open-source work. Her merged pull requests in the project start in 2020, reviewed by two other maintainers, and a 2021 commit by the project's founder adds her to the maintainers file. Her contribution graph goes back to 2014, which on its own would not have counted. Confirmed. The talk. The conference's 2021 programme, still on its website, lists "Tamsin Arlecourt, Quillmere Data", and the recording is on the conference's channel. Confirmed, and it also places her at Quillmere in 2021. Quillmere. Its website, quillmere.example, now redirects to the company that acquired it in 2022. The Delaware registry shows it incorporated in 2016, before her claimed start. Archived captures of its team page list her from October 2019 onwards, and captures from early 2019 do not. The acquirer's HR team, contacted with her consent, confirms her as a senior engineer from July 2019 to August 2022. The resume's start date is six months earlier than the employer's record, so that goes to the candidate as a question. The payments company. With her consent, it confirms her dates and title. Nothing public mentions the ledger migration, which is not unusual for internal work at a large company. Asked about the start date, Tamsin explains that from January to June 2019 she worked on Quillmere's team as a contractor, placed there by a contracting firm, and was hired in July. She names the firm, which confirms the placement. The US Bureau of Labor Statistics counts this arrangement as workers provided by contract firms: people who [work for a contract company, are usually assigned to only one customer](https://www.bls.gov/news.release/conemp.tn.htm), and usually work at that customer's worksite. Her resume folded the contract into the job. | Claim | Evidence | Status | | --- | --- | --- | | Master's, 2018 | Accreditation listing, registrar | Confirmed | | Open-source maintainer since 2021 | Reviewed pull requests, the commit adding her as a maintainer | Confirmed | | 2021 talk | The conference's own programme and recording | Confirmed | | Quillmere, January 2019 to August 2022 | Registry, archived team page, the acquirer's HR, the contracting firm | Explained: contractor January to June, employee from July | | Payments company, dates and title | Employer confirmation | Confirmed | | Led the ledger migration | Nothing public | Open | The open claim becomes an interview topic: what the migration involved, which decisions were hers, and who else worked on it. With her agreement, a reference from that team can speak to it. #### What a mismatch can mean Many mismatches have an ordinary cause. Henle and colleagues leave unintentional errors, such as forgetting the dates of jobs held long ago, out of their definition of resume fraud, and note that misrepresentations can come from honest mistakes, poor advice from placement services or forgotten information. | Mismatch | Common innocent cause | What to ask for | | --- | --- | --- | | Start date earlier than the employer's record | A contract period through an agency, or dates rounded to the year | The agency's name, a contract or an offer letter | | Company not found under that name | Renamed, acquired, or trading under a name other than its registered one | The former name or the acquirer | | Title differs from the employer's record | Internal titles often differ from the ones used on resumes | The internal title and level | | No degree record found | A name change since graduation | The name used at the school | | Overlapping roles | Part-time work, consulting, a notice period | Which role was full-time | | A gap | Study, caring, illness, a long search | What they were doing, if they choose to say | Fabrication tends to look different, and it survives the candidate's explanation: an employer with no trace in any registry, archive or third-party record, a school whose only accreditor is not recognised, a licence missing from the board that supposedly issued it, or a record that contradicts the resume outright. #### How to ask the candidate about gaps and discrepancies Ask about one thing at a time, and say what you found. "Our record shows you starting at Quillmere in July 2019, and your resume says January. Can you tell us about those months?" gives the candidate room to explain, and the explanation usually comes with something you can check. For anything beyond public information, such as contacting a former employer, asking a registrar to confirm a degree or requesting a transcript, tell the candidate what you plan to check and get their consent first. It is courteous, and candidates can often point you to a faster route, such as the agency that paid them or the name they studied under. #### Reading the results fairly This method finds what was recorded, and plenty of real careers leave little record. Engineers at large companies rarely appear on their employer's website, and some people keep no public profiles at all. Startups close, their domains lapse, and the archive has gaps of its own. Names change with marriage, and transliteration can give one name several spellings in different countries. So keep three outcomes apart. Confirmed means a record the candidate did not write agrees with the claim. Explained means a mismatch has an ordinary cause that you have checked. Open means you found nothing either way, and an open claim moves to the interview and the references. #### Where Sixtyfour fits Checking a resume by hand means working through registries, archives, repositories and programmes, one claim at a time. Sixtyfour's agent starts from what the application already contains, such as the candidate's email address, name or code-hosting username, researches public sources, and links what it finds to the same person. Every finding comes with its source, and anything it could not establish is reported as open rather than filled in. The results go to your hiring team, and a person decides what to ask and whether to proceed. There is more on how hiring teams use it on our [workforce identity page](https://www.sixtyfour.ai/solutions/workforce-identity). #### The short version Write the resume out as claims, and check each one against a record someone else wrote, weighed by who wrote it and when. Confirm details that are not public with the employer or school once the candidate agrees. Mark each claim as confirmed, explained or open, and ask the candidate about the rest before you decide anything. --- ### Shell company red flags: how to check and weigh each one *A crowded address or a busy director proves little on its own. What each red flag is evidence of, how to check it against a primary source, and what it means when several agree.* Source: https://www.sixtyfour.ai/blog/shell-company-red-flags Roham Mehrabi · 2026-10-05 · Trust & Safety The usual shell company red flags are a registered address shared with hundreds of other companies, directors who sit on dozens of boards, a filing history with no sign of trading, a website or phone number much younger than the business claims to be, ownership that runs through other companies without reaching a person, and no trace of staff, premises or customers. Each one has ordinary explanations, because formation agents, virtual offices, holding companies and special purpose vehicles are a normal part of business. To identify a shell company, check each flag against a primary source, work out what it is evidence of, and give weight to the flags that agree with each other and contradict what the company says about itself. This piece takes the flags one at a time, with one invented counterparty throughout. Our guide to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification) covers the wider onboarding process. This one is about reading the signals. #### What counts as a shell company The 2018 [FATF and Egmont Group report on concealing beneficial ownership](https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf) gives working definitions. A shell company is an "incorporated company with no independent operations, significant assets, ongoing business activities, or employees". A front company is a "fully functioning company with the characteristics of a legitimate business, serving to disguise and obscure illicit financial activity". A shelf company is registered and left dormant, often to be sold later. Companies with no operations of their own are common in ordinary business. [The Puppet Masters](https://star.worldbank.org/sites/star/files/puppetmastersv1.pdf), a 2011 study by the World Bank and UNODC's Stolen Asset Recovery Initiative, lists mergers, joint ventures, separating liabilities and holding personal or family assets among their legitimate uses. It also found companies used to hide the proceeds of corruption in 128 of the 150 grand corruption cases it reviewed, and in more than half of the cases involving a company, the company was a shell. The FATF and Egmont report calls shell companies the most common type of legal person in schemes to obscure beneficial ownership, and more than half of its 106 case studies specifically referred to them. So the useful question is whether the company's shape fits what it says it does. A holding company with no staff is normal. A wholesaler claiming seven years of trading, with no staff, no premises and a website registered last spring, needs a closer look. #### Shell company red flags at a glance | Red flag | What it can suggest | Where to check | Strength alone | | --- | --- | --- | --- | | Registered office shared with hundreds of companies | A formation agent or mailbox service | Registry search by address | Weak | | Director with a long list of appointments | A professional nominee, or a lent name | The officer's appointment list | Weak to medium | | New officers, name or activity code just before onboarding | A bought shelf company, or a change of control | Filing history | Medium | | Dormant accounts against a claimed trading history | The history did not happen here | Accounts and activity codes | Strong, as a contradiction | | Website or phone number younger than the claimed business | A footprint built for the application | Domain records, certificate logs, web archives | Medium to strong | | Phone number or email shared with other companies | One operator behind several companies | Searches of the number | Medium | | No staff, premises, customers or suppliers | No real operations | Profiles, reviews, job ads, filings | Medium, weak for new businesses | | Ownership that never reaches a person | Concealment, or an ordinary group | Ownership registers, leak databases | Weak to medium | These strengths are a starting point. A flag contradicting something the company told you counts for more than one that merely looks unusual, and two flags that come from the same fact count once. The worked case is invented. In September 2026, Ferrowdale Trading Ltd, a UK private company, applies to a payments company to take card payments as a wholesale distributor of consumer electronics. It says it has traded since 2019 and expects about £350,000 a month in card payments. Its website is ferrowdale.example. The registry shows it as active. #### How many other companies share the registered address? Formation agents, accountants and virtual office providers lend their address to clients. The UK's Office for National Statistics notes that a formation agent ["can register thousands of businesses at a single address"](https://www.ons.gov.uk/businessindustryandtrade/business/activitysizeandlocation/methodologies/multiplebusinessregistrationsatasinglepostcode2020), and the UK government's [guidance on setting up a company](https://www.gov.uk/limited-company-formation/company-address) suggests an accountant's or solicitor's address, or an agent who provides one, to anyone who does not want their home on the public register. In the FATF and Egmont report, the UK said that in practice about 75 percent of its companies are formed by gatekeepers, the professionals who set companies up for others. The same report explains why the address still matters. Companies managed by a service provider "will often share the same bulk address", and large numbers of shell companies "will be registered to the same address and telephone number". To check, search the address in the registry. Companies House's [advanced search](https://find-and-update.company-information.service.gov.uk/advanced-search) takes a full or partial registered office address and filters by incorporation date, which shows whether companies there were formed in batches. A crowded address tells you an agent is involved. It does not tell you which of the agent's companies is the problem. It becomes evidence when the companies there share officers, phone numbers and formation dates with yours. Ferrowdale's registered office is a formation agent's address in London, shared with about 2,300 active companies. On its own, that is context. #### How many boards does each director sit on? A nominee director appears on a company's records while someone else directs it. The OECD's 2001 report [Behind the Corporate Veil](https://www.oecd.org/content/dam/oecd/en/publications/reports/2001/11/behind-the-corporate-veil_g1ghgb3e/9789264195608-en.pdf) describes nominees who "appear as a director on all company documents and in official registries" while the beneficial owner does the directing. Just under half of the FATF and Egmont case studies involved formal nominees, and the report's indicators note that some are "mass" nominees for large numbers of companies. An appointment count is the quick check. Companies House shows a total number of appointments on each officer's page, and its [public data API](https://developer-specs.company-information.service.gov.uk/companies-house-public-data-api/resources/officersearch?v=latest) returns the same figure. The register also shows a director's [month and year of birth](https://www.gov.uk/guidance/your-personal-information-on-the-companies-house-register), which helps separate two people with one name. The count can understate. Companies House [explained in a 2019 reply on its blog](https://companieshouse.blog.gov.uk/2019/07/19/why-its-important-to-use-the-right-data/) that it matches appointments on name, date of birth and residential address, and generally creates a separate record where the details differ significantly. Search the name as well as the record. Then read the list. A family's property companies, a group's subsidiaries or an accountant's clients are ordinary. A run of short-lived companies formed at one address and dissolved within a year or two is a pattern. The FATF and Egmont report adds two cautions. Shared nominees can create "false links between companies", so two companies with the same professional director may have nothing else in common. And scale says little about any one company: in a New Zealand case, one provider supplied nominee directors for over 1,000 companies, and the authorities suspected at least 73 of them of facilitating crimes abroad. Ferrowdale's first director, appointed in 2019, holds about 640 appointments at the agent's address and resigned in June 2026, which fits a company formed for sale. The director appointed in June 2026 holds 23. Nineteen began in the last eighteen months, all at the same address, and eleven of those companies have been dissolved without filing accounts that show any trading. That list is worth keeping. #### What does the filing history say about trading? Read the filing history in date order. Dormant accounts say the company was not trading. The UK government says a company may be [dormant](https://www.gov.uk/dormant-company) if it is "not doing business ('trading')" and has no other income, and Companies House's [list of activity codes](https://resources.companieshouse.gov.uk/sic/) includes 99999, "Dormant Company", and 74990, "Non-trading company". A new name, new officers and a new activity code shortly before a company approaches you can mean a change of control. The FATF and Egmont indicators include "the resignation and replacement of directors or key shareholders shortly after incorporation". That is also the shape of a shelf company sale, after which, the report notes, a new owner can use the company's history "to help secure business relationships or lines of credit". None of this is wrong in itself. Buying a ready-made company is an ordinary shortcut, and plenty of companies sit dormant before they trade. What matters is whether the filings agree with the story. Ferrowdale was incorporated in March 2019 under another name and filed dormant accounts every year to 2025. In June 2026, three months before applying, it changed its name, its director and its activity code. The application says it has traded since 2019, and the filings say it has not, at least not through this company. That is the strongest finding so far, and it is a question the applicant can answer. #### Does the business have an operating footprint? An operating business leaves traces that other people created. The Puppet Masters notes that a company engaged in business "will typically market itself, join a chamber of commerce, build a website", and "will have employees". The FATF and Egmont report lists the reverse among shell indicators: only a post-box address, a lack of personnel, and no taxes or social benefits paid. Date the footprint as well as finding it. - A domain's RDAP record usually carries a registration event, which the [IANA registry of RDAP values](https://www.iana.org/assignments/rdap-json-values/rdap-json-values.xhtml) defines as when "the object instance was initially registered". A re-registration event, where the registry records one, marks a domain registered again later, possibly by someone new. - Certificate Transparency logs [publicly record TLS certificates](https://www.rfc-editor.org/rfc/rfc9162.html) as they are issued, so a domain's first certificate gives a second date for roughly when the site went live. - The Wayback Machine [lists the dates](https://help.archive.org/help/using-the-wayback-machine/) on which it captured a URL. - Search the phone number and email address. A number on several companies' websites links them; our guide to [investigating a phone number](https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number) covers dating one. - Look for staff whose profiles predate the application, reviews built up over years, suppliers and job ads. Front companies need the opposite reading. They have a footprint by design, so finding one settles nothing. What can give a front away is the FATF and Egmont indicator of "financial activities and transactions inconsistent with the corporate profile", which is often clearer in your own transaction data after onboarding. ferrowdale.example was registered in May 2026, its first certificate was logged that month, and its first archive capture is from July. The warehouse address on the site is the agent's. No staff profiles mention the company, and there are no reviews or trade listings. The site's phone number also appears on the websites of two other companies where the new director sits, and it is not the number the agent publishes for itself. The footprint is about four months old, for a business claiming seven years. #### Where does the ownership chain end? The OECD found that the corporate vehicles misused most often are those that give their beneficial owners the greatest anonymity. Follow the chain until it reaches a natural person or a documented dead end, and note each border it crosses. Where there is a register, start there. The UK lists people with significant control, usually anyone with [more than 25 percent](https://www.gov.uk/guidance/people-with-significant-control-pscs) of the shares or voting rights, or who can appoint or remove a majority of the directors or otherwise influence or control the company. For a foreign parent, check its own registry. The ICIJ's [Offshore Leaks database](https://offshoreleaks.icij.org/), covering more than 810,000 offshore entities, is worth a search, with the ICIJ's own caution that there are legitimate uses for offshore companies and trusts and that many people and entities share names. Jurisdiction alone is a weak signal. In the [Global Shell Games](https://gfintegrity.org/wp-content/uploads/2014/05/Global-Shell-Games-2012.pdf) field experiment, reported in 2012, researchers posing as customers sent more than 7,400 requests to more than 3,700 company formation providers in 182 countries. Nearly half of the replies (48 percent) did not ask for proper identification, and providers in tax havens were significantly more likely to ask than those in OECD countries such as the United States and Britain. Ferrowdale's register names the new director as holding 75 percent or more of the shares. The chain ends at a person straight away, so there is no layering flag. The register cannot say whether that person controls the company or lent it their name. #### Weighing the flags: what held up at Ferrowdale Two findings held up, each on independent sources. - The trading history. Seven years claimed, against dormant accounts every year to 2025 and a domain, certificate and archive record that all start in 2026. The registry and the web are separate sources that agree. - The new director's companies. A run of short-lived companies at the same address, and two of the director's current companies whose websites show the same phone number as Ferrowdale's. The appointments come from the registry and the phone match from the companies' websites, so this is two links. Two flags were context: the crowded address, explained by the agent, and the first director's 640 appointments, explained by a company formed for sale. A search for adverse media on the company and both directors found nothing; our guide to [adverse media screening](https://www.sixtyfour.ai/blog/adverse-media-screening) covers resolving a hit. Three things stay open: who controls Ferrowdale, where its stock is held, and where £350,000 a month would come from. That gives the analyst three requests: evidence of trading before June 2026, such as invoices or bank statements; who bought the company and why; and where the goods are stored. An honest business can answer all three, perhaps by explaining that it bought an aged company and overstated its history. The file records each flag, its source and the reason for its weight, so the decision can be checked later. #### Reading the evidence carefully Most red flags describe normal business shapes, so a fair review checks the ordinary explanation first. - A crowded address is a formation agent's or virtual office's normal output. - Holding companies, special purpose vehicles and group subsidiaries have no staff by design. Judge them by whether the structure fits the group around them. - New and small businesses are thin. Ask them for different evidence: contracts, a lease, the founders' own histories. - What a central registry captures [varies from jurisdiction to jurisdiction](https://star.worldbank.org/sites/star/files/puppetmastersv1.pdf), and a thin result from a thin register says more about the register than the company. - A register records what was filed. A name and a month and year of birth can separate two people, but they do not show that the person named is the one in control. And flags that share a source count once. A long appointment list and a crowded address are often the same fact seen twice, because one agent supplied both. #### Where Sixtyfour fits In a busy queue, the check that gets skipped is often the one that would have contradicted the story. Sixtyfour's agent starts from what the application contains, such as a company name, a director or a website, and researches public sources such as registry filings and the business's web footprint. It links findings to the right company and people, returns every finding with its source, and reports what it could not establish as open rather than filling it in. The results go to your team, and a person decides. There is more on how financial crime teams use it on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### The short version Treat each shell company red flag as a question with a primary source behind it: count the companies at the address, read each director's appointment list, read the filing history against the story, date the footprint, and follow the ownership to a person. Give weight to independent flags that contradict what the company told you, record the ordinary explanation for the rest, and mark what you could not establish as open. --- ### How to investigate a phone number *Reports often arrive with nothing but a phone number. What it can prove, how to date it, and why today's holder may not be the one you want.* Source: https://www.sixtyfour.ai/blog/how-to-investigate-a-phone-number Hashim Khawaja · 2026-09-30 · Trust & Safety To investigate a phone number, first normalise it to international format and read what the digits can tell you: the country, often a region, and sometimes the type of number. Then find out what kind of line it is today and whether it has moved between carriers, work out how long it has belonged to its current holder, and only then search for where it appears: breach records, listings, filings and accounts. Treat each result with care, because phone numbers are ported, shared and recycled, and the person holding a number today is often not the person attached to its oldest records. #### What a phone number can and cannot prove A phone number feels like a strong identifier. It is short, it is usually verified at signup, and most people keep one for years. For an investigation it has weaknesses that an [email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) mostly does not. A number can move between carriers, and from a mobile network to an internet phone service, without its digits changing. Household landlines, office lines and shared work phones put several people behind one number, and on a family or company plan the account holder is often not the person who uses the line. And numbers that are given up go back into the pool and are issued to someone else, often while the old owner's accounts still point at them. So every finding needs a date, and every link to a person needs a second source. #### Question one: what do the digits say? Start by writing the number in E.164 format: a plus sign, then the country code and the national number, with no spaces or punctuation. E.164 is the ITU's international numbering plan, and it [specifies at most 15 digits](https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md), one to three of them for the country code, though some valid numbers in Germany are longer. Normalising first matters for the same reason it does with email addresses. One number written as (312) 555-0148, 312.555.0148 and +13125550148 looks like three different values in a spreadsheet until someone converts them. The country code is a broad filter. The United States, Canada and several Caribbean islands [all share +1](https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md). And as the [FAQ](https://github.com/google/libphonenumber/blob/master/FAQ.md) of Google's open-source phone number library puts it, many people have phone numbers that do not belong to the country they live in, particularly mobile numbers. That library, [libphonenumber](https://github.com/google/libphonenumber), is widely used for this step, and Android has used it since version 4.0. It parses, formats and validates numbers and can often tell you the type of number from the digits alone. Its documentation is careful about the limits, and they are worth knowing: - A valid number is one from a range that carriers can assign. The FAQ says not to rely on the library to tell you whether a number is currently assigned to anyone or reachable. - In some countries, including the US, mobile, landline and most internet phone numbers come from the same ranges, so the digits cannot tell you which one you have. The library reports those as fixed line or mobile. - Where it has carrier data for a country that allows porting, it returns the carrier originally assigned the number, which may not be the one serving it today. For US numbers it has almost none. So the digits give you a country, a rough region where the numbering plan is geographic (in the US, for mobile and landline numbers alike), and sometimes a type. They do not give you a person, and they do not tell you what network the number is on now. #### Question two: what kind of line is it now? For that you need a lookup against current carrier data, which commercial number lookup services provide. The result usually gives the carrier serving the number today, often the carrier that originally held it, and a line type: mobile, landline, internet phone or something more specialised. Portability is why this is a separate step. The FCC's consumer guide explains that people who switch providers while staying in the same area can [keep their number](https://www.fcc.gov/consumers/guides/porting-keeping-your-phone-number-when-you-change-providers), including moves between landline, internet and wireless providers. When today's carrier differs from the original one, the number has most likely been ported, unless the original carrier has since merged or rebranded. | What the line looks like | What it suggests | What it does not tell you | | --- | --- | --- | | Mobile | Served by a mobile carrier, usually on a phone plan | Who holds it now, or since when | | Landline | Served by a fixed-line carrier, often a home or office line | That the line is at the address you expect | | Internet phone number (VoIP) | Can often be set up and dropped quickly | That anyone is hiding anything, since plenty of people and businesses use them | | Toll-free or premium rate | A business or service line | Anything about an individual | | Invalid or unassigned range | A typo, a formatting error or an invented number | Intent | An internet phone number is easy to over-read. Some can be set up online in minutes, which suits a throwaway identity, but on its own the line type proves nothing. #### Question three: whose number is it now? This question decides whether the rest of the evidence is about the right person. Numbers are reissued on a large scale. Researchers at Princeton who [studied number recycling](https://recyclednumbers.cs.princeton.edu/assets/recycled-numbers-latest.pdf) cite an FCC estimate of around 35 million US numbers disconnected every year. Of 259 numbers on offer to new subscribers at two major carriers that they identified as probably recycled, 171 were still tied to existing accounts at popular websites. So old records attached to a number may belong to a previous holder who has nothing to do with your case. Contact data goes stale the same way: a database that once matched a number to a named person can go on listing that person long after the number has passed to someone else. Date everything. For each record that mentions the number, note when it was created and what name or account it points to. If the records split into an older cluster under one name and a newer cluster under another, you are probably looking at two holders, and only one of them is in your case. #### Question four: where does it appear? Now search, with the number in each of its common formats. Breach data can date a number. The Facebook data scraped in 2019 and leaked in 2021 is a good example: [Have I Been Pwned lists it](https://haveibeenpwned.com/Breach/Facebook) at 509,458,528 accounts, every record in it included a phone number, and only 2.5 million included an email address. Facebook said the data was scraped [before September 2019](https://about.fb.com/news/2021/04/facts-on-news-reports-about-facebook-data/), so, by Facebook's own account, any number in it was on a Facebook profile before then. Have I Been Pwned no longer takes phone numbers in its website search, but its [API still supports them](https://www.troyhunt.com/have-i-been-pwned-2-0-is-now-live/), so a number can be checked without handling the leaked file. Use a breach hit to date a number, not to name its holder. A name in a leaked record is unverified, and it may belong to an earlier holder. Public listings are the other rich source: classified ads, rental and vehicle listings, business directory entries, company filings, and the contact details people once published themselves on forums and personal sites. A number that appears in listings under several different names in a short period is a much stronger signal than any line type. Your own platform counts as well. The same number verifying several accounts, or appearing in several sellers' listings, is a link between them, with the caveats in our guide to [linking related accounts](https://www.sixtyfour.ai/blog/how-to-link-related-accounts). #### A worked example The case below is a composite, and the number in it comes from the 555-0100 to 555-0199 range reserved for fiction, so it does not belong to anyone. A dating platform's trust and safety team receives two reports about one profile. In both, the conversation moved to a messaging app within a day, and a few days later the profile asked for money to cover an emergency. The profile gives its name as Daniel, 41, an engineer in Austin. Its verified phone number is +13125550148. The digits. A US number with a Chicago area code. The digits cannot say whether it is mobile or a landline. A Chicago number on an Austin profile is not unusual in itself, because people often keep their numbers when they move. The line. A current-carrier lookup shows an internet phone provider, while the number was originally held by a mobile carrier. So it has probably been ported. The holder. Two public records, a 2017 forum post and a 2018 business directory entry, list it under a woman's name in Illinois. Nothing ties it to anyone else until this year. Where else it appears. Searching the number in its common formats finds two classified ads posted this year, one for an apartment to rent and one for a car, in two different cities, each asking for a deposit by bank transfer. One is signed Mark and the other Sam, and the car ad reuses a photo from Daniel's profile. Put together, the number had an earlier holder, visible in records from 2017 and 2018, and has been used this year behind at least three names that ask for money, two of them tied together by the same photo. The woman in Illinois is most likely a previous holder rather than a suspect, and the report records her only as that. The team can act on the profile, look for other accounts on the platform verified with the same number, and keep an innocent person out of the case. #### What to leave alone Do not call or text the number. It tells the holder someone is looking, which often leads them to delete the accounts you were about to find, and with a recycled number you may be contacting someone who has nothing to do with the case. Do not pose as someone else to get details from a carrier or from the holder. It can alert the holder, and anything learned that way is hard to stand behind in a report. Do not run lists of numbers through messaging apps' contact discovery. Saving one number as a contact shows you whatever profile the holder chose to make visible, and that is ordinary use. Doing it in bulk is how the Facebook data was collected: Facebook said scrapers used software imitating its app to [upload large sets of phone numbers](https://about.fb.com/news/2021/04/facts-on-news-reports-about-facebook-data/) through its contact importer and see which matched users. In a study published in 2025, researchers at the University of Vienna and SBA Research showed the same weakness in WhatsApp's contact discovery, [confirming more than 3.5 billion accounts](https://www.univie.ac.at/en/news/detail/researchers-discover-security-vulnerability-in-whatsapp), after first reporting the problem to the company. #### The innocent explanations Most of what makes a number look suspicious has an ordinary explanation, and a fair report checks for it first. Shared lines are common. A household landline or an office number reaches several people, so a name attached to it may belong to anyone in the house or on the team. People keep their mobile numbers when they move, sometimes across states and sometimes across countries, so an area code that does not match a stated location proves nothing by itself. A number with almost no public trace is normal for a new number, a new holder, or someone who keeps their details offline. See whether the email address or name it leads to has more history before drawing anything from the silence. And a port or an internet phone line is context. Plenty of people change carriers to save money, and plenty of small businesses run on internet numbers, so neither counts against anyone on its own. #### How Sixtyfour fits Done carefully, the four questions take time, and in a busy queue the first name that turns up can belong to a previous holder. Sixtyfour's agent starts from the number, researches where it appears across public sources, and returns each finding with its source. When a number turns out to belong to someone other than the person it was linked to, it says so, and it reports anything it could not establish as open. From there it can carry on from an email address or a name the number leads to. #### Before you rely on a number Normalise it and read the digits, check what kind of line it is today, date every record so that its holders separate, and only then search. Give each finding a date, confirm each link to a person with a second source, and mark what you could not establish as open. --- ### Adverse media screening: how to review a hit *Many adverse media hits are about someone else, and many of the rest need context. How to resolve a hit, read what it alleges, and record the decision.* Source: https://www.sixtyfour.ai/blog/adverse-media-screening Roham Mehrabi · 2026-09-30 · Trust & Safety Adverse media screening, also called negative news screening, is the search of news and other public sources for negative information about a customer or the people behind it, especially anything that points to financial crime: fraud, corruption, money laundering, sanctions evasion, tax crime and the like. Most of the work is in deciding whether an article is about your customer, what it says happened, and whether any of it changes how you should treat the relationship. This piece follows a single alert through those decisions, one step at a time. For how adverse media fits into checking a business customer as a whole, see our guide to [KYB verification](https://www.sixtyfour.ai/blog/kyb-verification). #### Why so many hits are noise A screening search starts with a name, and names are shared. In the 2010 US Census, [2,442,977 people](https://www.census.gov/topics/population/genealogy/data/2010_surnames.html) had the surname Smith. A search on a common name returns everyone who has it, and a search on an uncommon one still returns anyone whose name is spelled similarly. Names carried between languages and scripts multiply the possibilities. The Wolfsberg Group, an association of global banks, gives an example in its [negative news screening FAQs](https://wolfsberg-group.org/resources/guidances-principles-standards-and-faqs/118): Piotr Czajkowski, Pyotr Tchaikovsky and Piotr Chaykovskiy are the same name, written three ways. Names also appear in different orders, shortened to initials, or with and without a middle name or a second surname, so a system that matches loosely enough to catch every variant also catches a great many strangers. The second source of noise is context. Your customer can be named in an article without being accused of anything. Each hit raises a few questions, starting with whether it is about your customer at all. #### Is the article about your customer? Resolve the identity before you read the allegation. Otherwise a vivid story about a stranger colours everything that follows. The Wolfsberg FAQs separate strong grounds for clearing a hit, such as a clearly different name or a mismatch in a key identifier like date of birth or gender, from weaker ones such as profession or place of residence, which make a match less likely without ruling it out. Compare whatever the article gives you against what you hold: | Identifier | How much it settles | What to watch for | | --- | --- | --- | | Date of birth or age | A lot, when present | Articles give age at the time of the story, so work out the birth year | | City or country | Some | People move, and a city can have many residents with the name | | Occupation or employer | Some, more when an employer is named | Job titles in news copy are loose | | Company name or registration number | A lot, for business customers | Similar company names in other countries | | Other people named | Often decisive | A co-director or family member who appears in both | | Photograph | Some | Low-quality images, and photos of a different person with the same name | Most articles carry only a few of these. A single strong mismatch, such as an age that is twenty years out, is usually enough to clear a hit. Agreement on one weak identifier is not enough to confirm one. #### What part does your customer play in the story? A true identity match still needs reading. Note what role the customer has: the subject of the allegation, a victim, a witness, someone quoted, or a company in the same sector as the one under investigation. Only the first is adverse. The rest are context, and clearing them is quick once you have read the article rather than the snippet. The Wolfsberg FAQs list a customer who is not the subject of the story, such as a plaintiff, as a reason to discount the hit. #### How far did the story get? Every adverse story describes a matter at one point in its life. The Wolfsberg FAQs describe the progression as a "risk stage" that "starts with an allegation, which then likely becomes an investigation which may lead to charges ending with a conviction". A matter can also stop at any point, or end in an acquittal. Plenty stop. In the 2023 fiscal year, US attorneys [declined to prosecute 54 percent](https://bjs.ojp.gov/document/fjs23.pdf) of the fraud suspects in the matters they concluded. In the most recent Bureau of Justice Statistics study of felony cases in the 75 largest US counties, which followed cases filed in May 2009 for a year, [about a quarter of the cases decided within that year ended in dismissal](https://bjs.ojp.gov/content/pub/pdf/fdluc09.pdf). Early stages also tend to get more coverage than outcomes, so a case being dropped can get far less attention than the arrest did. When an article reports an early stage, search for what happened next before you record it: a later report of the outcome, a court record, an official statement, or a correction from the publisher. Record the stage you could confirm, and say plainly when the outcome is unknown. #### One story or ten? Several articles can trace back to a single report. A [2018 study of a year of articles from major Dutch news outlets](https://ijoc.org/index.php/ijoc/article/view/7109) found that at the country's largest news site, three in four articles were based on copy from the largest national news agency, and that much of the online news it studied reused agency text with little or no editing. A press release can also be republished almost word for word by outlets that never checked it. So group the hits that describe the same event in the same words, and trace them back to the first report or the underlying document. A court filing or an official statement carries more weight than a summary of it, and an anonymous blog post or a forum thread carries less than either. The Wolfsberg FAQs describe source credibility in similar terms: content that has been through editorial oversight is generally more credible, content that readers can edit or that reads as opinion is less so, and a report that other reputable sources corroborate is more reliable than one they do not. #### Does it matter for this relationship? A confirmed, adverse, well-sourced story still needs weighing against what the customer is going to do with you, on three things: how serious the matter is, how recent it is, and how relevant it is. Financial crime, corruption and sanctions evasion bear directly on most financial relationships. A decade-old traffic offence does not. On recency, the Wolfsberg FAQs suggest deciding how far back screening should look, and say a multi-year look-back may be appropriate, for all coverage or with longer or shorter periods for different kinds of offence. An old story still counts, and it should be read alongside everything that has happened since. On relevance, an allegation about how someone ran a payments business matters more to a payments provider than the same allegation about their conduct in an unrelated hobby club. #### Writing the decision down Every hit should end in a recorded decision that someone else can follow later, and the Wolfsberg FAQs say procedures should require a recorded rationale for every alert decision, including the ones cleared as false positives. The possible outcomes are few: cleared as a different person, cleared as context, cleared as an unreliable source, noted as a true match that does not change the risk, or escalated for review. The record needs five things: the article and where it came from, the identifiers you compared and the result, the customer's role in the story, the stage the matter reached, and the conclusion with the reviewer's name. With those written down, the decision can be checked, or revisited when the story develops, without starting again. #### One alert, start to finish The alert below is a composite, and the people in it are invented. A payments company is onboarding a sole trader who runs a restaurant in Manchester. The customer gave a full name and a date of birth in 1981. Screening on the name returns fourteen articles. Nine are about a local politician with the same name in another country, aged in his sixties. The age and the country both differ, so all nine are cleared as a different person in one step. Two are local news stories about a burglary at a restaurant whose name matches the one on the application, and the customer is quoted as its owner. Right person, but the customer is the victim. Cleared as context. The remaining three describe a man with the same name, aged 38 in 2019, who was charged that year with fraud connected to a restaurant business in Manchester. An age consistent with a 1981 birth, the city and the trade all fit, so this is treated as a probable match, with the supporting identifiers recorded. On reading, the three articles are one wire report carried by three sites, which makes it one source rather than three. A search for the outcome finds a short court report from 2020 saying the case was discontinued. So fourteen hits come down to one relevant story, probably about the customer, which reached a charge and was then dropped. The file records each step: which hits were cleared and on what grounds, which report the three articles came from, and the court report on the outcome. The case goes to a reviewer with the question already narrowed to one thing: whether a case discontinued in 2020 changes anything for this account. #### Screening every customer fairly A screening process can end up treating some customers worse than others for reasons that have nothing to do with risk. Some names are shared by far more people than others, and names from some languages have more spelling variants in Latin script. Customers with those names will generate more hits, so judge each hit on what it shows rather than on how many there are. The number of hits mostly reflects how common a name is and how often the people who share it make the news. On its own it says little about risk. Results also age. A customer who was clean at onboarding can appear in tomorrow's news, and one who was once charged can have been cleared since. Re-screen on a schedule that matches the risk, and re-read old true matches when you do. #### Where Sixtyfour helps Sixtyfour's agent does the research behind each hit. It searches news and records for potentially adverse coverage of a customer and the people behind it, and puts each result beside the identifiers that support or weaken the match, with its source attached. Anything it could not establish is reported as open. Your analysts review the evidence, and the decision about the relationship stays with them. --- ### How to evaluate AI tools for investigations *AI research agents can take on much of an investigation's legwork. Five checks tell you whether their results will hold up when someone asks how you know.* Source: https://www.sixtyfour.ai/blog/ai-tools-for-investigations Saarth Shah · 2026-09-30 · Trust & Safety AI tools for investigations are research agents that start from an identifier, such as a name, an email address, a username, a phone number or a company, and search public sources to build a sourced picture of who or what is behind it: accounts, records, connections and adverse media. They take on much of the collection and cross-referencing an analyst would otherwise do by hand. Before relying on one, check five things: that every finding carries a source you can open, that it says "unknown" instead of guessing, that it tells apart people who share a name, that its collection stays passive, and that it gets cases right when you already know the answer. By investigations, this piece means people and company investigations: trust and safety, fraud, due diligence, hiring and open-source intelligence work. #### What these tools do well Much of an investigation's time goes on collection: searching one identifier across dozens of sources, following it to the next identifier, reading records in other languages, and noting where each fact came from. That work is repetitive, and it grows with every identifier you follow. This is the part an agent is good at. It can run many searches at once, pivot from an email address to a username to an old forum account without losing the thread, read a scanned filing, and hand back a structured result with its sources attached. Our guides to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) and [spotting fake candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates) show what that collection involves when it is done by hand. The judgement stays with the investigator: whether a link is strong enough to act on, what a finding means for the case, and what happens to the person or company at the end of it. The agent collects and organises, and the investigator decides. #### Five checks before you rely on one ##### 1. Every finding has a source you can open Citations only help if you open them, because a sourced finding can still be wrong. Check that each page says what the tool says it does. A [2025 study involving 22 public service media organisations](https://www.ebu.ch/news/2025/10/ai-s-systemic-distortion-of-news-is-consistent-across-languages-and-territories-international-study-by-public-service-broadcaste) shows why. It found serious sourcing problems, meaning missing, misleading or incorrect attributions, in 31 percent of the answers that four widely used AI assistants gave to news questions. Those were general assistants rather than investigation tools, but the failure is the same one to test for. Test it directly. Take twenty findings from a few results, open every source, and count how many support the claim as written. Watch for the near misses: a real page that mentions a different person with the same name, or an article that says something weaker than the summary above it. Sources need dates as well, because pages change and come down, and a finding is only as current as the day its source was read. The [Berkeley Protocol on Digital Open Source Investigations](https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf), published by the UN human rights office and UC Berkeley's Human Rights Center, asks human investigators to record the search paths that led to each piece of material, when and by whom it was collected, and their method in enough detail that someone else could repeat it. A tool that does the searching for you should keep that record for you. ##### 2. It says "unknown" instead of guessing For an investigator, a blank field is cheap and a wrong one is expensive. A blank tells you to keep looking. A confident wrong answer can end up in a report. Language models lean the other way by default. A [2025 paper on why language models hallucinate](https://arxiv.org/abs/2509.04664) argues that standard training and evaluation reward a confident guess over an admission of uncertainty. The broadcasters' study above found major accuracy issues, including hallucinated details and outdated information, in 20 percent of the answers it reviewed. So test for restraint as well as recall. Include a few subjects with thin public footprints and see whether the tool returns gaps or fills them. The result you want is a list of what was established, what was not, and why. ##### 3. It gets the right person among people who share a name In the 2010 US Census, [2,442,977 people](https://www.census.gov/topics/population/genealogy/data/2010_surnames.html) had the surname Smith, and each of the ten most common surnames was shared by more than a million people. A wrong identity match is one of the most expensive mistakes in people research, because everything found after it belongs to someone else. A good tool anchors to what you already know, such as an employer, a city, an email address or a date of birth, and explains why each new account or record belongs to the same person. Test it with a subject whose name is common, and with one who has a namesake in the same field or city. Read the reasons it gives for each link, not only the links. ##### 4. Collection stays passive Open-source collection should not touch the subject. The Berkeley Protocol draws its definition of open source information along that line: such information "does not involve interacting with or soliciting information from individual Internet users". For a tool, that rules out logging into the subject's accounts, triggering password resets, messaging people, or anything else that would tell someone they are being looked at or that relies on access nobody authorised. Ask the vendor directly what the tool does to collect, and look for anything in the output that could only have come from an active step. Ask where your queries go as well. The names and identifiers you search are sensitive in their own right, and you should know how long they are kept and who can see them. ##### 5. It holds up on cases you already know Your own closed cases make the best test, because you know what the right answer was and how hard it was to find. The next section sets out how to build one. Run the same case twice as well. Systems built on language models can give different answers to the same question even with settings meant to make them repeatable, and a [2024 study of "deterministic" model settings](https://arxiv.org/abs/2408.04667) measured variations in accuracy of up to 15 percent across runs on standard benchmarks. Some variation is normal, and it should sit at the edges of a result, such as an extra old account found one time and not the other. The core identity should not change between runs. #### Build your own test set Twenty to thirty closed cases should surface most of a tool's failure modes. Pick them so that each one tests something specific: | Include | What it tests | | --- | --- | | Subjects with rich public footprints | Recall, and whether sources are cited properly | | Subjects with thin footprints | Whether the tool reports gaps instead of filling them | | Common names, and pairs of people who share a name | Identity resolution | | An identifier that changed hands, such as a recycled phone number or a reassigned work email address | Whether the tool checks dates before linking | | Names in other scripts or languages | Transliteration and non-English sources | | A company with a similarly named counterpart | Entity resolution for organisations | Score every field as correct, wrong or missing, and weigh a wrong answer as worse than a missing one. Separately, count the citations that do not support the claim they are attached to. The first half of that is how RECON scores. RECON is the people research benchmark we built, externally validated by HUD, and it covers 140 real people and 514 verified fields, with roughly a quarter of the people paired with a same-named decoy. Its headline metric is weighted accuracy: correct answers minus wrong answers, divided by every field. A wrong answer costs a point, and a blank costs nothing. Every system tested so far, ours included, has given some wrong answers, so a person should read the result before anyone acts on it. The [latest results and methodology](https://www.sixtyfour.ai/recon-benchmark) are on the benchmark page. #### What Sixtyfour's agent returns Sixtyfour builds AI research agents for people and company investigations. The agent starts from the identifiers you have, such as a name, email address, phone number or company, researches across public records, breach records, social profiles, code hosting, forums, archived pages, filings and news, and returns findings with a source attached to each one. It says which accounts and records it believes belong to the same person and why, and reports what it could not establish as open rather than filling it in, so an investigator can check every finding before acting on it. #### The checks, in brief - Open the sources. Count how many support the claim as written, and check they are dated. - Give it thin footprints and see whether it admits gaps. - Give it common names and pairs of people who share a name, and read its reasons for each link. - Ask what it does to collect, and where your queries go. - Run your own closed cases, twice, and score wrong answers as worse than blank ones. Run these checks on your own cases and you will know where a tool's results can be trusted and where a person still needs to look. --- ### How to link related accounts in a trust and safety investigation *Shared IPs, devices and cards connect accounts, and they also connect strangers. How to weigh each link, and when a cluster is really one operator.* Source: https://www.sixtyfour.ai/blog/how-to-link-related-accounts Julian Wong · 2026-09-29 · Trust & Safety To link related accounts, list every value the accounts share, weigh each shared value by how many other accounts on your platform also have it, and count only links that come from independent evidence. A payout account shared by two accounts is a strong link. An IP address shared with thousands of other users is barely a link at all. Treat a set of accounts as one operator when at least two strong, independent links agree, and keep everything weaker as a lead. Common linking mistakes come from skipping one of those steps: a cluster built on a busy IP address, a ban that swept up someone's flatmate, a "ring" that turned out to be one university library. #### What linking is for Much of the abuse that costs a platform money runs on more than one account. A banned seller comes back under a new name. One person claims a sign-up promotion forty times. A group of accounts reviews each other's listings, or passes money around until one of them cashes out. Handled one account at a time, each of these becomes a queue that never empties, because the operator opens the next account. Linking moves the unit of work from the account to the person or group behind it. It also raises the cost of getting it wrong. A false link punishes someone for another person's behaviour, and they rarely find out why. #### The signals, and what each one proves | Shared value | Why it links accounts | Common innocent reasons | Starting weight | | --- | --- | --- | --- | | Payout bank account or card | The money has to reach someone | Family members, a small business paying out to one account | Strong | | Verified phone number | Verification needed the number at that moment | Recycled numbers, a shared family phone | Strong when the dates are close | | Email address, after normalising | One inbox receives both accounts' mail | Shared family or business inboxes | Strong | | Profile or listing photo | The same file was uploaded twice | Stock images, copied listings, and photos taken from someone else | Medium, and it never links the person pictured | | Device identifier or fingerprint | The same machine was used | Shared household devices, public computers, very common configurations | Medium | | Distinctive username or naming pattern | People reuse handles | Common words and first names | Weak to medium, depending on rarity | | IP address | The same network was used | Mobile networks, shared carrier addresses, offices, public wifi, VPNs | Weak | | Timing and behaviour | The same habits | Time zones and ordinary routines | Weak alone, useful as support | Normalise identifiers before comparing them. Gmail [ignores dots](https://support.google.com/mail/answer/7436150) in Gmail addresses and delivers mail sent to [name+anything](https://support.google.com/mail/answer/22370) to the same inbox, so one person's accounts can look like several until the addresses are normalised. The dot rule only covers consumer Gmail addresses, though. Dots do matter in work and school addresses hosted by Google, so normalising every Google-hosted domain the same way creates false links. Treat the weight column as a starting point. Three things move it: how rare the value is, whether the link is independent of the others, and when each account used it. #### Rarity sets the weight A shared value links two accounts in proportion to how few other accounts share it. So before drawing a line between two accounts, count how many accounts on your platform have that value. Call it the fan-out. Start with IP addresses. An IETF document on carrier-grade NAT defines it as a way to [share the same IPv4 address among several subscribers](https://www.rfc-editor.org/rfc/rfc6888.html), and a [2016 measurement study](https://arxiv.org/abs/1605.05606) found it in more than 90 percent of the cellular networks it examined. Another IETF document, on the [problems address sharing causes](https://www.rfc-editor.org/rfc/rfc6269.html), states the consequence: an address and a time are not enough to identify one subscriber when the address is shared. Researchers who studied [sockpuppets in online discussion communities](https://arxiv.org/abs/1703.07355) removed the most heavily used IP addresses before they started, because the accounts behind them may simply have been sitting behind a country-wide proxy or an intranet. Device fingerprints are more distinctive than IP addresses, but less so than their reputation suggests. According to a [survey of browser fingerprinting research](https://arxiv.org/abs/1905.01051), the early studies that found more than 80 percent of browsers unique drew on privacy-conscious volunteers, while a 2018 study of about two million fingerprints collected on one of the top 15 French websites found only 33.6 percent unique, and 18.5 percent on mobile. Fingerprints also drift: in one long-running study, nearly half had changed at least once after a single day. Record linkage weighs agreement by rarity. The model Ivan Fellegi and Alan Sunter formalised in 1969, which a [US Census Bureau research report on record linkage](https://www.census.gov/content/dam/Census/library/working-papers/2006/adrm/rrs2006-02.pdf) starts from, scores a pair of records by how likely its pattern of agreement is among true matches compared with non-matches, and can weight agreement on a name by how common that name is. It also sorts pairs into three groups rather than two: matches, non-matches, and possible matches held for a person to review. A shared surname of Smith tells you less than a shared surname of Tarvelle, and a shared IP address tells you less than a shared payout account, for the same reason. Usernames follow the same rule. In a [2011 study of linking usernames](https://www.freehaven.net/anonbib/papers/pets2011/p1-perito.pdf), johnsmith and johnsmith82 were too common to link despite looking alike, while daniele.perito and d.perito could be linked despite looking less alike. So record the fan-out beside every link. A value shared by two accounts is evidence. A value shared by two thousand is background. #### Two links from one fact count once Links only add up when they come from independent evidence. The same IP address and the same city are one observation, because the city came from the IP address. A shared email address and a username copied from its first half, such as jsmith82@ and @jsmith82, are one observation too, because one was made from the other. For each new link, ask whether it would still be true if the first link turned out to be a coincidence. If a flatmate explains the shared IP address, the same flatmate probably explains the shared device fingerprint. A shared payout account is less exposed, because a flatmate rarely shares a bank account, though a family member might. #### When each account used it Every link has a date, and the date changes what it means. Two accounts on one IP address in the same hour are a different finding from two accounts that used it eleven months apart. Phone numbers need particular care. Princeton researchers who [studied number recycling](https://recyclednumbers.cs.princeton.edu/assets/recycled-numbers-latest.pdf) cite an FCC estimate that around 35 million US phone numbers are disconnected and placed back in the pool every year. When they sampled 259 numbers available to new subscribers at two major carriers, 171 were still tied to existing accounts at popular websites. A number that verified one account in 2019 and another in 2025 may have belonged to two different people. Activity timing can support a link, though it rarely proves one alone. The sockpuppet study above combined it with network data to identify likely sockpuppets: posts from the same IP address, in the same discussion, within 15 minutes of each other, in at least three different discussions. Creation order carries information as well. A new account that appears the day after a ban, from the banned account's device, is the pattern ban evasion leaves. Two accounts that have sat quietly on the same home connection for five years are more likely to be a couple. #### Reading a cluster fairly Many of the false links a platform will draw come from a short list of ordinary situations. Households, shared flats, offices and student halls put many real people on one connection, and often on one device. People share accounts too. In a 2016 Pew Research Center survey, [41 percent of American online adults](https://www.pewresearch.org/internet/2017/01/26/2-password-management-and-mobile-security/) said they had shared the password to one of their accounts with friends or family, and in a 2013 survey, [27 percent of internet users](https://www.pewresearch.org/internet/2014/02/11/couples-the-internet-and-social-media/) who were married or in a committed relationship shared an email account with their partner. Mobile networks, and some home broadband providers, put unrelated customers behind the same public address, so a shared IP address from a carrier range says very little. People use VPNs for privacy, travel and work, and a popular VPN exit address is shared by strangers all over the world. Recycled phone numbers connect a new owner to an old owner's accounts. A stolen photo links the accounts of whoever uploaded it. The person in the picture is usually a victim, and treating them as part of the cluster turns the victim into a suspect. An account takeover is the hardest case. A hijacked account starts to share devices and networks with the attacker's other accounts, but its original owner did nothing wrong. When an old, quiet account suddenly joins a cluster, look for a password reset, a new email address or a first login from a new device before you act on it. Wikipedia, which runs its sockpuppet investigations in public, is careful about the same thing. Its [CheckUser policy](https://en.wikipedia.org/wiki/Wikipedia:CheckUser) says the tool "is not magic wiki pixie dust", and adds: "An editing pattern match is the important thing; the IP match is really just extra evidence (or not)." Its [sockpuppetry policy](https://en.wikipedia.org/wiki/Wikipedia:Sockpuppetry) warns that people who use the same computer or network connection risk being accused of running each other's accounts. #### One cluster, worked through This case is a composite, and every account in it is invented. A marketplace bans a trading-card seller for shipping counterfeits. Over the next three weeks, four new seller accounts register in the same category. Account A pays out to the same bank account as the banned seller, and only these two accounts have ever used it. A's first login, the morning after the ban, also came from the banned seller's device. Only three accounts have ever used that device, and the third is account D. At a fan-out of three, a link the table starts at medium counts as strong here. A household could explain a shared bank account and a shared device, but not a new seller account that opens on that device the morning after the ban and sells the same cards. A has two strong links, independent of each other. Account B shares a device fingerprint with a second phone that account A logs in from. That fingerprint also matches 38 other accounts, because it belongs to a popular phone model with default settings, and B shares nothing else. B stays unlinked, and the fingerprint is kept as a lead. Account C used the same IP address as the banned seller. The address belongs to a mobile carrier and appeared on thousands of accounts that month, so it is not a link. Account D lists twelve product photos that are byte-identical to the banned seller's old listings. On its own that could be a copycat lifting someone else's images, so it counts as support rather than as a link. D has two strong ones. It logged in from the banned seller's device, the one only three accounts have used. And its verified phone number, which no other account uses, appears in a trading-card classified ad posted a month before the ban and signed with the banned seller's username. That username is unusual, and no one else on the classifieds site uses it, so the ad ties D's number to the banned seller. So A and D go to review together as the same operator as the banned seller, with every link and its fan-out attached. B and C stay unlinked, and the file says why. #### Where the platform's data stops Apart from D's classified ad, everything so far uses signals your platform collected itself. They answer one question well: which accounts here share money, devices, numbers and networks. They cannot tell you who is behind a cluster, or whether the same person runs accounts on other platforms. Both questions are answered outside your systems. The handle from a banned account turns up on a forum. The phone number on a new seller's listings appears in older ads with a name attached. An email address sits in a breach record next to a username used on other sites. Each of these connects accounts that share nothing inside your platform, and each needs the same discipline: how rare is the shared value, and is it independent of the other links. Our guide to [investigating an email address](https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address) goes further into tracing one identifier off-platform. #### Writing the link down Write each link down as you make it, so someone else can check it later and it can be undone cleanly if it turns out to be wrong. For each one, record the shared value, its type, when each account used it, its fan-out, and which other links it depends on. Then match the action to the evidence. A cluster held together by strong, independent links can support a ban. A cluster held together by weak ones supports a step-up check, a limit, or a closer look. Keep actions reversible where you can, and let a person make the final call. #### Where Sixtyfour comes in Your platform holds the device, network and payment data, and linking on those belongs in your own systems. Sixtyfour works on the half that lives outside them. Starting from an account's email address, phone number, username or name, the agent traces where each identifier appears across public sources, works out which of those appearances belong to the same person, and reports every link with its source and the reason it believes the link holds. Anything it could not establish is reported as open. The results come back to your team, and a person decides what happens next. There is more on how trust and safety teams use it on our [trust and safety page](https://www.sixtyfour.ai/solutions/trust-and-safety). --- ### KYB verification: checking a business is real, not just registered *A KYB check can confirm that a company was registered. The harder part is showing that it trades, who controls it, and that the bad news you found is about it.* Source: https://www.sixtyfour.ai/blog/kyb-verification Roham Mehrabi · 2026-09-24 · Trust & Safety KYB verification is the work of confirming that a business customer is who it says it is. In practice that means three things: showing that the business exists and operates, identifying the people who own and control it, and screening the business and those people for sanctions and adverse media. KYB tooling is good at the first step: confirming that a company with a given name and number appears on a registry. Most of the risk sits in the rest. This piece walks through each part, the point where each one usually stops short, and what it takes to close the gap. It uses one worked example throughout, the same one on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). #### What a registry match proves A company registry records what was filed with it. Filing is not the same as verification, and some registries say so outright. The UK's Companies House is one. Its [service information](https://resources.companieshouse.gov.uk/serviceInformation.shtml) explains that it checks documents are complete and signed but has no power to verify what they say, and that a filing on the register "should not be taken to indicate that Companies House has verified or validated it". That is changing. Since [18 November 2025](https://www.gov.uk/government/news/companies-house-confirms-identity-verification-rollout-from-18-november-2025), new directors and people with significant control have had to verify their identity, with existing ones brought in over a transition that runs to late 2026. It is a real improvement, and what it verifies is the people named on a filing. It does not verify that the company trades. In the US, companies are formed at state level, and formation agents let one street address serve as the registered office for a very large number of entities. A [2012 New York Times investigation](https://www.nytimes.com/2012/07/01/business/how-delaware-thrives-as-a-corporate-tax-haven.html) found at least 285,000 businesses using a single building in Wilmington, Delaware, as their legal address. There is nothing wrong with that. It is how registered agents work. But it does mean that the address on a filing tells you where the paperwork goes, not where the business is. So a registry match establishes that an entity with that name and number was formed and, usually, that it is still in good standing. It is necessary. It says nothing about whether the company trades, how long it has traded, or who is really behind it. A shelf company bought last month, a dormant entity reactivated for one purpose and a genuine twenty-year-old distributor all return the same clean match. #### Part one: corroborate that the business operates An operating business leaves traces it did not create for the purpose of passing a check. Those traces are what corroboration looks for. The website is the obvious start, and the questions are about age and consistency rather than existence. When was the domain registered, and does that date sit sensibly against the incorporation date and the history the applicant describes? Does the site describe the same business as the application and the registry's activity code? Is the contact address the registered agent's address, or somewhere goods could plausibly be stored and shipped from? Beyond the website, look for evidence that other people have dealt with the business over time: customer reviews that build up over years rather than arriving in a single week, job postings, and staff whose professional profiles predate the application and name the company. Trade directory listings and supplier mentions help, and so do filed accounts whose size fits the turnover the applicant expects to put through your platform. Contradictions are more useful than confirmations. A company claiming ten years of trading on a domain registered this spring. A product catalogue made of stock photos with placeholder text still in the footer. A warehouse address that turns out to be a virtual office. None of these proves fraud. Each is a question the applicant can answer, and an honest business usually answers it easily. "Not established" is a legitimate result. If the registry supports the legal identity and the website is real but nothing shows the business operating before this year, the finding is exactly that, and it should be recorded as an open question rather than rounded up to a pass or down to a fail. #### Part two: find the people behind it Start with who counts. The usual definition of a beneficial owner is every individual who owns 25 percent or more of the business, plus one individual with significant responsibility to control or manage it. Definitions vary from country to country, and higher-risk customers often justify looking below the threshold. Where the ownership information comes from matters as much as the threshold. Public ownership registers help where they exist. The UK publishes people with significant control on the Companies House register, which is a useful start and carries the same caveat as everything else filed there. Elsewhere, what you can see varies a great deal from country to country, and for many companies there is no public register to check at all. The practical consequence is that ownership usually arrives as a declaration from the customer, and the work is corroborating it. Follow each layer of the structure until it reaches a natural person or a documented dead end. A holding company is one more layer to follow, and one registered in another jurisdiction may have filings you cannot read, which is itself worth recording. Two patterns are worth watching for: nominee officers and directors supplied to fill every office on the public record, and a business that gives only a registered agent's address. The most common error in this part is treating a shared name as a connection. The applicant's director and a director of some other company have the same name. That is a lead. It becomes a link when something besides the name matches: a date of birth where the registry publishes one, a service address, a co-director who appears on both, the same formation agent, the same correspondence address, or a signature pattern across filings. Until then it stays in the report as a name match, clearly labelled, and it does not go into the risk score as though it were a finding. Our field brief on [tracing hidden beneficial owners behind shell companies](https://www.sixtyfour.ai/blog/how-we-trace-hidden-beneficial-owners-behind-shell-companies) goes further into the layered structures this part runs into. #### Part three: screen, then resolve before you escalate Sanctions and politically exposed person screening is list-based, and it is the part of KYB with the most mature tooling. Adverse media is different. It searches unstructured news and records for negative coverage of the business and its owners, and its main failure is volume. The volume comes from matching names. A search for a company name returns every article about every business with a similar name, and a search for a director returns every person who shares theirs. [Industry guidance on negative news screening](https://wolfsberg-group.org/resources/guidances-principles-standards-and-faqs/118) describes discounting a hit as a false positive where the names differ significantly or where secondary identifiers such as a date of birth or a date of incorporation do not match. The fix is to resolve the entity before treating a hit as relevant. For a business, that means checking the jurisdiction, the registration number, the named directors, the dates and the industry in the article against the customer. For a person, it means the identifiers the article carries, which is often not many. A hit that survives resolution then needs weighing by what it actually says: an allegation, an investigation, a charge and a conviction are four different things, and a single report repeated by ten outlets is still one report. Keep three things separate in the file: the article, the reasoning for why it does or does not refer to your customer, and the analyst's conclusion. When anyone reviews the case later and asks why it was cleared, that separation is what answers them. #### A worked example The case below is a composite, and the business in it is invented. Brantholm Trading applies for a merchant account as an industrial equipment distributor. The KYB API returns a clean registry match: the legal name on the application matches the filing, the company is active, the registered office is on file. Corroboration. The trading website exists and has a product catalogue and contact details, which fits the application. Nothing yet shows how long the business has been trading, so operating history goes down as not established. Ownership. The filing names one direct shareholder, Brantholm Holdings, and one director, Alex Morgan. The holding company is a second layer to follow. The director's name also appears on another company's filing. Nothing else on the two filings matches yet, so it is recorded as a name match to review, not as a connection. Adverse media. One article describes a commercial dispute involving Brantholm Trade BV. The name is close, but the article's company is registered in a different jurisdiction from the applicant and none of its named people appear on Brantholm Trading's filing. Resolved as a different entity, with the reasoning kept beside the article. What comes out is a legal identity that checks out, an operating history that is not yet established, an ownership structure followed one layer down with one unresolved name, and an adverse media hit that was about someone else. That gives the analyst a short, specific list of what to ask the customer for, before anyone has decided anything. #### How deep each check should go Not every business customer needs every step at full depth, and a KYB programme that treats a local bakery like an offshore payment processor will be slow for the bakery and no safer for it. The usual approach is to set depth by risk. Registry, ownership declaration and screening for everyone. Deeper corroboration and full ownership tracing when something raises the risk: a high-risk industry, owners or parents in other jurisdictions, a structure more complex than the business seems to need, answers that do not fit the evidence, or expected volumes that do not fit the size of the company. #### Reading the results fairly New businesses are legitimately thin. A company incorporated last month has no trading history to find, and treating youth as a red flag rejects every genuine startup. For a new business, ask for different evidence: the founders' own histories, signed contracts, a lease. Small businesses may have almost no online presence. Many sole traders and trades businesses have no website and never will. Registries differ a great deal in what they publish and how current it is, and some jurisdictions publish very little. A thin result from a thin registry says more about the registry than the company. Names collide, and transliteration makes it worse. A name written in another script can be spelled several ways in Latin letters, and common names generate matches no amount of tuning removes. Resolution by other identifiers is the only real answer. And KYB goes stale. Ownership changes, directors resign, a dormant company is sold. A check that was right at onboarding describes that moment, not the customer you have today, so it is worth running again when something changes: a new owner or director, a jump in volume, or anything that calls the earlier picture into question. #### Where Sixtyfour fits A KYB API confirms that an entity is registered and that its documents are genuine, and it should stay in your stack. Sixtyfour works on the questions a registry match leaves open. Starting from what the application already contains, the agent researches the business's operating footprint, follows directors, shareholders and connected entities across filings, and puts potentially relevant adverse media beside the identifiers that support or weaken the match. Every finding carries its source, and anything it could not establish is reported as open rather than filled in. It adds investigative context to your screening and case review. It is not transaction monitoring and it does not make the decision. --- ### How to detect synthetic identity fraud *A synthetic identity passes KYC because every piece of it checks out. What it usually lacks is the past a real person builds up without trying.* Source: https://www.sixtyfour.ai/blog/how-to-detect-synthetic-identity-fraud Julian Wong · 2026-09-23 · Trust & Safety Synthetic identity fraud is hard to detect because every piece of a synthetic identity can check out on its own. The Social Security number is valid, the credit file exists, the address receives mail and the phone number answers. To find one, stop checking the pieces one at a time and ask whether a life surrounds them. Does the identity have the age, the incidental history and the connections to other people that anyone accumulates without meaning to? A synthetic identity is built to pass inspection. It is rarely built to have a past. #### What a synthetic identity is The Federal Reserve's [industry-recommended definition](https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/synthetic-identity-payments-fraud/synthetic-identity-fraud-defined/) is the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. In the US the usual recipe is a real Social Security number combined with a name and date of birth that belong to nobody. The number is typically taken from someone without an active credit profile, and the Fed notes that [children's numbers are the favourite](https://fedpaymentsimprovement.org/wp-content/uploads/protect-kids-from-synthetic-identity-fraud.pdf), because they usually go unused until the child's late teens and almost nobody is watching them. Because the person does not exist, nobody checks the identity's credit report or disputes a charge on its accounts. The crime still has a victim. As the [Boston Fed points out](https://www.bostonfed.org/news-and-events/news/2022/08/synthetic-identity-fraud-is-not-a-victimless-crime-costs-billions-damages-lives.aspx), the real owner of the number, often a child, can find their credit ruined and not learn about it until they are old enough to apply for credit or a job. What the fraudster relies on is the silence in between, and it can last for years. #### How a synthetic identity gets a credit file The credit bureaus create the file themselves. As the Boston Fed describes it, the first application in the new identity's name is usually rejected, because there is no credit history. But the lender's inquiry leaves the bureau holding a file for the identity. The fraudster keeps applying until a lender approves something small, and from then on the identity builds a record like anyone else. The record can be accelerated. The Fed describes fraudsters adding a synthetic identity as an authorised user on well-established accounts with high credit limits, a practice it calls [piggybacking](https://fedpaymentsimprovement.org/wp-content/uploads/spot-a-synthetic.pdf), so the new identity inherits years of someone else's repayment history. The real account holder is sometimes paid to allow it. Then, usually after months or years of on-time payments, the identity borrows as much as it can across every account it holds and stops paying. The Fed's term for this is [busting out](https://fedpaymentsimprovement.org/wp-content/uploads/frs-synthetic-identity-payments-fraud-white-paper-july-2020.pdf): maxing out a line of credit with no intention to repay. The Federal Reserve's own toolkit makes the point that matters most for detection: until that moment, a synthetic identity in a portfolio [often behaves like a model customer](https://fedpaymentsimprovement.org/resources/synthetic-identity-fraud-mitigation-toolkit/how-synthetic-identities-are-used/), and once the loss happens there is often nothing to show it was fraud. It looks like a real customer who could not pay. Credit bureau data put US lenders' exposure to suspected synthetic identities, across auto loans, bank and retail credit cards and unsecured personal loans, at a [record $3.3 billion](https://www.transunion.com/report/h1-2025-omnichannel-fraud-report) at the end of 2024 and [$2.7 billion](https://www.transunion.ca/content/dam/transunion/ca/business/collateral/report/canada-h2-2025-fraud-trends-update-report.pdf) at the middle of 2025. #### Why the usual checks pass it A typical KYC check asks whether the name, date of birth, address and Social Security number on an application appear together in credit and data sources. After a few months of applications, they do. The bureaus and data brokers hold the identity because the fraudster's own activity put it there, so a check that compares data against data is checking the synthetic identity against itself. The Fed's detection guidance says as much: synthetic identities [often pass KYC verification](https://fedpaymentsimprovement.org/resources/synthetic-identity-fraud-mitigation-toolkit/detecting-a-synthetic-identity/). Document checks stop crude attempts. Where a document is needed at all, a good forgery or a generated one can get through, and many digital onboarding flows never ask for one. Behavioural and credit models see perfect repayment right up to the bust-out, because the repayment is real. There is nothing wrong to see until there is a lot wrong all at once. One older check stopped working in 2011. Until that June the first three digits of a Social Security number tied it to the state that issued it, and numbers were assigned in a known sequence, so a number could be tested for plausibility against an applicant's age and where they said they grew up. The Social Security Administration's [randomisation](https://www.ssa.gov/employer/randomization.html) ended both, and that plausibility test went with them for every number issued since. The strongest single control in the US goes to the source. The Social Security Administration's [eCBSV service](https://www.ssa.gov/dataexchange/eCBSV/), rolled out from late 2020, lets banks and other financial institutions check, with the customer's written consent, whether a name, date of birth and Social Security number match SSA's records, and tells them which element does not. It catches the most common recipe, a real number under an invented name, and any lender that can use it should. It also has limits. SSA says plainly that it [does not verify a person's identity](https://www.ssa.gov/news/en/press/releases/2020-10-29.html): it confirms that three pieces of data belong together. It depends on a Social Security number and the customer's consent, and it does nothing for the many platforms that onboard people without collecting a Social Security number at all: marketplaces, gig platforms, many payments and crypto products, and anyone outside the US. #### What a real identity has that a synthetic one does not Set the data aside and look at the life around it. Three things are hard to manufacture. Age that agrees with itself. A real adult's email address, phone number, address history, credit file and online presence all start at different times, most of them long before today's application. A synthetic identity's traces tend to begin together, at roughly the moment it started applying for credit. Incidental presence. Real people leave traces they never curated: a review of a local garage, a name on a race results page, a post in a hobby forum, an old account on a service nobody uses any more. None of it was created to prove anything, which is exactly why it is expensive to fake. We made the same argument about [fake job candidates](https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates), and it holds for the same reason. Other people. A real person is connected to other real people: relatives at the same address over many years, colleagues who list the same employer, a partner on a lease. A synthetic identity's connections are thin, or they loop back into the other identities in the same ring. #### The signals worth checking | Signal | What it looks like | The innocent explanation to rule out | | --- | --- | --- | | Age mismatch | An eight-year credit file, and an email address with no trace older than 18 months | A genuinely new email address, which people do change | | Shared attributes | The same address unit, phone, device or email pattern across applicants with different surnames | Families, flatmates and shared devices | | Borrowed history | A file whose age comes mainly from authorised-user accounts belonging to strangers | A parent adding a child as an authorised user, which is common and legitimate | | Throwaway infrastructure | Mail forwarding addresses, virtual offices, prepaid or internet phone numbers | Many real people use internet phone numbers | | An empty life | No public records beyond credit, no professional or social presence, nobody else ever mentions them | Privacy-conscious people, recent arrivals, the young | Every one of these signals has a common innocent cause, which is why the right-hand column is there. The useful question is whether several of them line up on one applicant. Shared attributes deserve particular attention, because they are the signal a synthetic ring cannot easily avoid. A ring running dozens of identities has a limited supply of addresses, phones and devices, and it reuses them. That reuse is invisible to anyone looking at one application at a time and obvious to anyone looking across all of them. #### A worked example The run below is a composite assembled from the pattern, not one real case. An application for an unsecured personal loan. The credit file is six years old, the score is respectable, and the history consists of two authorised-user accounts opened long ago on other people's cards and one card of the applicant's own, opened three years ago and paid on time every month. Every data-match check lines up. The research starts from what the application contains: the name, the email address, the phone number and the address. The email address appears in no public source older than fourteen months, and in no breach records at all. The phone number is an internet phone number. The address is a unit in an apartment building, and three other applications to the same lender in the last two quarters gave the same unit, under three different surnames. There is no professional profile and no social account older than a year. One thing does not fit. A university alumni list carries the same name with a graduation year that matches the stated date of birth. The name is fairly common, so it may be someone else entirely, or it may be the one genuine anchor in the file. The research cannot say which, and pretending otherwise would be guessing. So the output is an identity whose data checks out and whose life appears to begin about eighteen months ago, sharing an address with three other applicants, plus one open question. That is more than enough to route the application to step-up verification, and not enough to call it fraud. #### When to run the check At onboarding, because that is the cheapest point to stop a synthetic identity. But also at the moments a patient fraudster is waiting for: a large credit line increase, a new high-limit product, a sudden request for more after a long quiet period. A real customer's footprint keeps growing between those points. A synthetic identity's often does not, which gives a second look at month eighteen something to find that the first look at month zero could not. #### What defeats this An identity that was aged on purpose. Operations that open email accounts, social profiles and phone numbers years before they use them, and let those accounts sit, will produce a footprint that looks earned, because in a sense it was. Aged accounts are also bought and sold for exactly this reason. An identity that borrows a real person's life. The closer a synthetic identity sits to a real person's details, the more of that person's genuine footprint it can lean on. This approach raises the cost of a convincing synthetic identity. It does not make one impossible, and the identities that get through are the ones somebody spent real time and money on. #### Reading a thin file fairly Plenty of real people have thin files and thin footprints. Young adults. People who arrived in the country recently. People who have simply stayed out of credit. People who keep off the internet on purpose, including people who have left an abusive partner and removed every trace they could. The CFPB's [most recent estimate](https://files.consumerfinance.gov/f/documents/cfpb_update-credit-invisibles-estimate_2025-06.pdf), published in 2025 from December 2020 data, is that 2.7 percent of US adults, about 7 million people, have no credit record at all. That count leaves out everyone whose record is merely thin. A system that reads thinness as fraud declines exactly the people who most need a first credit product, for a reason none of them could do anything about. So treat thinness as a reason to verify further, not a reason to decline. The signals that point to fraud rather than to a quiet life are contradictions and sharing: traces that disagree about the identity's age, and attributes that turn up under other names. Absence on its own should only ever buy a closer look. #### How Sixtyfour runs it Sixtyfour's agent starts from what the application already contains, usually an email address, a phone number, a name and an address, and researches outward across breach records, public records, social and professional profiles, archived pages and other public sources. It weights each hit by how hard it would have been to manufacture, so a forum post from 2016 in a thread with other people replying counts for far more than a profile created last month. Every finding comes back with its source, and anything it could not establish is reported as open. It informs the step-up decision, and the credit decision stays with your team. There is more on how it fits a fintech or lender's review process on our [financial institutions page](https://www.sixtyfour.ai/solutions/financial-institutions). --- ### How to investigate an email address *An email address is often the only identifier a report arrives with. Here is what it can tell you, the order to read it in, and where it misleads.* Source: https://www.sixtyfour.ai/blog/how-to-investigate-an-email-address Saarth Shah · 2026-09-22 · Trust & Safety To investigate an email address, work outward in four passes. Read the address itself, check the domain it sits on, establish how long it has existed, and then find the accounts attached to it. Weigh every finding by how hard it would have been to fake, and keep every step passive: nothing in a sound investigation touches the account or tells its owner that someone is looking. The rest of this piece goes through the passes in the order we run them, what each one is evidence of, and the mistakes that turn a good lead into a wrong answer. #### Why the email address is the place to start Trust and safety queues, fraud alerts and investigation referrals tend to arrive with very little attached. A reported seller comes with the email on the account, and a tip sometimes names an address and nothing else. Of the identifiers you are likely to be handed, the email address is usually the most useful to start from. People keep an address for years and use it to sign up for everything, so one address tends to sit underneath dozens of accounts its owner has forgotten about. It is also close to unique to one person. A username can be claimed by a stranger on any service where it happens to be free, and a phone number goes back into circulation when its owner lets it lapse. Google says a deleted Gmail address [can't be used by anyone in the future](https://support.google.com/mail/answer/61177). Not every provider works that way, which matters later. #### Pass one: read the address Before any lookup, the string itself carries information. The part before the @ often holds a name, a set of initials, a handle or a number. A two-digit number at the end is often a birth year or the year the address was made, and it is worth writing down as a hypothesis rather than a fact. A distinctive local part is a pivot: the same string as a username on other services is one of the first things to check. Normalise before you compare anything. Gmail [ignores dots](https://support.google.com/mail/answer/7436150) in the part before the @, and it [delivers mail sent to name+anything](https://support.google.com/mail/answer/12096) to the same inbox. So j.tarvelle84, jtarvelle84 and jtarvelle84+shop all reach one person. For a trust and safety team this cuts the other way too. An operator who opens ten accounts under ten spellings of one Gmail address looks like ten customers until someone normalises the column. #### Pass two: read the domain The domain sorts the address into one of three rough groups, and each needs different work. A large free provider says little on its own, because most people use one. A disposable or temporary-mail domain is a strong signal about intent at signup, because the address was made not to last. Community-maintained lists of these domains exist, and [one widely used list](https://github.com/disposable-email-domains/disposable-email-domains) on GitHub holds close to 9,000 of them. Treat a miss on a list as uninformative. New disposable domains appear faster than anyone can list them. A custom domain is where most of the information is. Look up its registration date through RDAP, which [ICANN made the definitive source](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) for generic top-level domain registration data in January 2025, in place of WHOIS. Check whether it has mail records, whether it hosts a website, and whether that website agrees with what its owner has told you. An address on a domain registered three weeks ago, for a company that says it was founded in 2015, is a contradiction worth recording. Registrant details are usually redacted now, but the creation date almost always survives. #### Pass three: establish how old the address is Age is the most useful single thing to know about an address, and there is nowhere to look it up. It has to be inferred from the traces the address has left. Breach data is the strongest of those traces. If an address appears in the [2012 LinkedIn breach](https://haveibeenpwned.com/Breach/LinkedIn), it existed in 2012, whatever else turns out to be true about it. Date the address by when the breach happened, not when it surfaced: that one was stolen in 2012 and did not appear publicly until 2016. Have I Been Pwned lets you check an address against the breaches it indexes, and its [API](https://haveibeenpwned.com/API/v3) does the same for a single address with a paid key. Absence runs the other way, more weakly. Most addresses that have been in everyday use for years have turned up in at least one breach. So an address that is supposedly old and heavily used, with no breach history at all, is unusual. The same empty history is completely normal for an address that is genuinely new, or that belongs to someone careful. It is a question to hold open, not an answer. Other traces set a floor on age as well. The earliest archived page that mentions the address. The oldest public account that uses it. A Gravatar profile, which Gravatar [looks up by a SHA-256 hash](https://docs.gravatar.com/rest/hash/) of the trimmed, lowercased address, so an address can be checked without contacting anyone. And old public commits: Git records the author's email in every commit, and on a public repository [that metadata is public](https://docs.github.com/en/account-and-profile/how-tos/email-preferences/setting-your-commit-email-address) unless the developer has switched to a private noreply address. #### Pass four: find what is attached This is the pass that turns an address into a person, and it is where most wrong answers come from. Search for the exact address, in quotes, on general search engines. Search the local part as a username. Look for the address in the places people once posted it themselves: forum signatures, old classified listings, domain registrations from before redaction became standard, conference attendee lists, package registries and code. Every hit needs one question answered before it goes into a report: is this the same person, and how do I know? An exact match on the full address is strong. A matching username on another service is much weaker, especially when the handle is short or common. A matching name is weaker still. #### What each check is evidence of | Check | What a hit shows | What it cannot show | | --- | --- | --- | | Reading the local part | A name, handle or year worth testing | That any of them is true | | Domain type | Free, disposable or custom mail | Who controls the address | | Domain registration date | When the domain was created | When this address was created | | Breach records | The address existed by the breach date | That today's holder is the original one | | Gravatar and linked profiles | A profile someone attached to the address | That the profile's details are accurate | | Username reuse elsewhere | A lead worth following | That the other account is the same person | | Public code commits | A developer used the address in their work | Anything about identity beyond that | #### What not to do A few common techniques are best left out of a professional investigation. Do not use other services' signup or password reset forms to test whether an address is registered there. Answering those forms differently for known and unknown accounts is a recognised weakness, and [OWASP's guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) tells services to give the same response either way. Well-run services now do, so the results are unreliable. Some services also email the account holder about the attempt, which is the fastest way to tell a suspect that someone is looking, and the probing can breach the service's terms. Do not try to verify an address by talking to its mail server. The [SMTP standard](https://www.rfc-editor.org/rfc/rfc5321) lets servers switch off the command meant for checking an address, and in practice it is usually off. A server can also accept a recipient without deciding whether it exists, and a domain set up to take mail for any address will say yes to everything. Never use a password from a breach, not even to confirm a match. Logging in with someone else's credentials is access nobody authorised, whatever the reason for doing it. Passive methods also make better evidence. Something you found in a public record can be shown to a colleague, a customer or a court. Something you found by poking at a login form usually cannot. #### A worked example The case below is a composite built from a common pattern. The names and addresses in it are invented, and example.com stands in for a large free mail provider that, like Gmail, ignores dots. A marketplace's trust and safety team receives three buyer complaints about one seller in a week. The seller's phone number goes to voicemail, and the account has one email address: jonah.tarvelle84@example.com. The address first. A first name, a surname and 84. The surname is rare, which makes a username pivot worth more than usual. The domain says nothing by itself. Normalised, though, the address matches two other seller accounts on the same marketplace, both registered in the past month with the dots in different places. That moves the case from three complaints about one seller to three accounts behind one inbox. Age. The address appears in two breaches, the older from 2016. Whoever controls it now, it has existed for at least a decade. Attachments. The handle jtarvelle84 exists on a photography forum, with posts going back to 2015, from a city 200 miles from the seller's stated location. It also exists on a gaming site, created last year, with no activity. One of the old forum posts is a listing for a camera lens with the same email address written out in full. That leaves two stories sitting on one address. A real person with a ten-year-old inbox and a long, unremarkable forum history. And a cluster of new marketplace accounts using that inbox this month. The shape fits a compromised or bought account better than it fits someone defrauding buyers under their own name. It proves neither, and the report says so: three facts, one confirmed connection, and one open question about who holds the inbox today. #### Why this does not scale by hand Each pass is quick on its own. Run carefully, with every finding checked and sourced and the result written up, one address can easily take an experienced analyst the better part of an hour. That cost is the same whether the address turns out to matter or not, so busy teams ration it, and the rationing tends to fall on the cases that already looked suspicious. Sixtyfour's agent runs the four passes from the address alone, in parallel, and returns what it found with a source attached to every finding: where the address appears, how old each trace is, which attached accounts it believes belong to the same person and why. It weights each hit the way this piece does, by how hard it would have been to manufacture. A reviewer gets something they can check rather than a score they have to trust. There is more on how this fits an investigation team's workflow on our [investigations page](https://www.sixtyfour.ai/solutions/investigations). #### Reading the evidence carefully Addresses change hands. Yahoo [released dormant usernames for re-registration](https://www.cnn.com/2013/06/20/tech/web/yahoo-recycled-email) in 2013, and expired company domains put every address on them back up for grabs. A breach record from 2014 shows that the address existed then. It does not show that the person holding it now held it then. Shared inboxes are common. Couples and families share addresses, small businesses run everything through one, and a role address like info@ belongs to whoever is working that day. Common local parts mislead. A handle made of a first name and a number will match strangers on every large service. The rarer the string, the more a reuse match is worth. Quiet results mislead as well. People who guard their privacy, who have just moved countries or who rarely post anything will all look thin. When a search comes back quiet, try a different identifier before reading anything into it. #### The short version Read the address, then the domain, then its age, then what is attached to it, and keep every step passive. Weigh each finding by how hard it would have been to fake, and mark what you could not establish as open. Handled that way, one address becomes a short list of sourced facts that a reviewer can check. --- ### How to spot fake candidates before the interview *Interviews test whether someone can do the job. A constructed identity usually can.* Source: https://www.sixtyfour.ai/blog/how-to-spot-fake-candidates Julian Wong · 2026-09-18 · Trust & Safety Most advice about spotting fake candidates is advice about interviews. Ask harder questions, call the references, add a live coding round. That catches someone who inflated their experience. It does not catch a constructed identity, because the person on the call has been coached, the references answer the phone, and the portfolio contains real work. In July 2024 the security training company KnowBe4 hired a North Korean operative into a principal software engineer role. By [KnowBe4's own account](https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us), the candidate used a valid US identity stolen from a real person and a photograph that was an AI-manipulated stock image, cleared a background check, and appeared on camera in four video interviews on four separate occasions. The company laptop was shipped to an address that turned out to be a laptop farm, and it began loading malware the day it arrived. KnowBe4's security team contained the machine about 25 minutes after the first alert, and says nothing was taken. That company sells security awareness training. Its hiring process was not careless. The point of the story is that every stage of a normal, competent process returned a pass. #### The operation behind it The people doing this are funded and organised, which is why they will spend months on one identity. The Justice Department's [June 2025 actions](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote) against North Korean IT worker schemes give a sense of the machinery. Searches of 29 known or suspected laptop farms across 16 states, carried out between October 2024 and June 2025, seized roughly 200 computers along with financial accounts and fraudulent websites. In one Massachusetts case, now [resolved by guilty pleas and sentencing](https://www.justice.gov/opa/pr/two-us-nationals-sentenced-facilitating-fraudulent-remote-information-technology-worker), the government says the defendants compromised the identities of more than 80 US citizens to obtain remote jobs at more than 100 US companies, costing those companies at least 3 million dollars in legal fees and remediation. A single facilitator gives the clearest picture of the scale. [Christina Chapman](https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-information-technology-worker-fraud-scheme-generated-revenue) ran a laptop farm out of her home in Arizona and was sentenced in July 2025 to 102 months for wire fraud conspiracy, aggravated identity theft and money laundering conspiracy. According to the Justice Department, that one operation used 68 stolen identities, defrauded 309 US businesses, and generated more than 17 million dollars. Investigators seized more than 90 laptops from her house, and she had shipped 49 more overseas, some to a city in China on the North Korean border. North Korea is the best documented version of this and it is not the only one. The same techniques serve proxy interviewing, one engineer quietly holding four jobs, and contractor fraud through staffing chains. What they share is that the identity is the product, and the identity is built to survive inspection. #### What this looks like from inside a security company Casco builds an agentic security engineer, software that probes your own code for what is exploitable in it. That makes Casco worth the setup cost, and their founder describes the result without much drama. Testimonial: casco | Rene Brandel | CEO and founder, Casco | We see fake North Korean workers apply to Casco. Sixtyfour flags adverse media and resume inaccuracies before we ever get on a call. He talks about it at more length in [our case study with Casco](https://www.sixtyfour.ai/#case-studies). The phrase worth sitting with is "before we ever get on a call." KnowBe4's process failed at four separate interviews. Screening that runs on the application never asks the interview to be the thing that catches it. #### Why the interview is the wrong place to look An interview tests whether someone can do the job, and a fabricated candidate is often a real engineer working under a false name, so they can. Every artifact the hiring process inspects is an artifact that was prepared for it. A background check has the same blind spot, and it is a more specific blind spot than it first appears. A background check confirms that a real identity exists and that nothing bad is attached to it. It does not confirm that the person in the interview is the one that identity belongs to. When the identity is stolen from a real US citizen with a clean record, a background check returns clean because the record is clean. It is answering a different question from the one you need answered. #### Why you cannot do this by hand An analyst can run the checks in the rest of this piece manually. It takes a few hours per candidate, and it costs the same few hours whether the answer turns out to be interesting or not. At real hiring volume that budget does not exist, so one of two things happens. The check gets skipped, or it gets run only on candidates who already looked wrong. The second is worse than it sounds. A prepared identity is built specifically to not look wrong, so screening on suspicion searches the population least likely to contain one. Filtering by stage is different from filtering by suspicion. Running the check on everyone who reaches a given stage is fine, because the stage is not correlated with the thing being hidden. Running it only on people who seemed off is much weaker, because that is the one filter the operation is built to pass. #### What a real person leaves behind Someone who has been online for a decade leaves a trail they never curated. Three questions on Stack Overflow from 2019. A comment on somebody else's bug report. An attendee list from a conference in a city they used to live in. An expired domain. A username that also appears on a forum about mechanical keyboards, tied to the same address as a Steam profile. None of that was created to prove anything, and that is what makes it expensive to reproduce. One convincing profile is cheap. Ten years of incidental presence, spread across services that do not talk to each other and that nobody thought to coordinate, is not. #### The four signals Thinness. Presence exists but has no age and no incidental edges. Every account was created inside a narrow window, and none of them connect to anything outside the professional story. Contradiction. The timeline does not survive cross-referencing. Two roles overlap by eight months. A degree comes from a university whose alumni records do not carry the name. A stated location disagrees with the timezone on the commits. Reuse. The same photograph, phone number, device fingerprint or payment detail appears under a different name somewhere else. Reuse has real innocent explanations, and they are common: people change names on marriage or transition, carriers recycle numbers constantly, and families share devices. What survives that is narrower and still useful, which is the same photograph presenting as two different people on two currently active professional profiles. Its value is that it is invisible to anyone looking at one application at a time, because it requires a corpus the candidate cannot see. Infrastructure. The residential address is a mail forwarder. The phone number is VOIP. The bank account was opened six weeks ago. The laptop's traffic terminates somewhere the CV never mentions. #### How the check runs Sixtyfour's agent starts from whatever the application already contains: an email address, a phone number, a code hosting handle, a name. It never takes the CV's account of the person as its starting point, so it cannot be steered by what the CV chooses to mention. It cross-references breach records, public records, social profiles, code hosting, forums and archived pages, and weights each hit by how hard that hit would have been to manufacture. An account opened last year counts for very little. A forum post from 2016, sitting in a thread with other people replying to it, counts for a lot. #### What that looks like on one candidate The run below is a composite assembled from the pattern, not one real case. A backend role. The candidate gives an email address, a CV listing four years across two companies, and an active GitHub. The agent runs the address. Inside a minute it has the GitHub, a LinkedIn created in the same month as the GitHub, one social account with nine followers, and nothing else. There are no breach records at all, which is unusual for an address a CV implies has been in use for eight years. The phone number sits in a VOIP range. Then the timeline. The CV puts four years at a company in one city. The commit timestamps cluster in a working day nine hours away from it. One thing does not resolve. There is a GitHub contribution history going back six years, which is older than everything else and does not fit the rest of the picture. It could be a purchased account, or it could be the one genuine thing in the application. The check cannot say which, and reporting it as suspicious would be guessing. So the output is three concrete inconsistencies and one open question. That is a list of things to ask about, and it arrives before anyone has spent an hour on a call. #### What defeats this An identity that was aged deliberately. Any operation prepared to open accounts two years before it uses them, post in real threads, and let the presence accumulate will produce a footprint that looks earned, because in the sense that matters it was. A purchased account with real history attached. A real person renting out their own past, which leaves genuine incidental presence and a genuine owner who will answer a reference call. This method raises the cost of a convincing identity. It does not close the door completely. The public cases are the operations that did not spend enough. #### Reading the signals fairly Plenty of real people have thin footprints. Someone who stays off social media. Someone who moved countries recently and left their earlier presence in another language and another alphabet. Someone who is twenty-two. A system tuned to read thinness as fraud turns all three away, and nobody hears why. The four signals above are deliberately limited to what a record can show. An accent, a non-US phone number or an unfamiliar name says nothing about whether an identity is genuine, and leaning on them only turns away real engineers. So thinness on its own only justifies looking closer. Contradiction and photo reuse are stronger, and both call for an explanation rather than a conclusion. The setup we recommend is a review queue: the check runs on every candidate who reaches a defined stage, and anything it flags goes to a person. The scoring is good enough to act on. A person sits at the end of it because the question is whether to offer someone a job, and somebody should look at that and decide. #### The short version Run the check on the application, for everyone who reaches the same stage. Treat what it finds as questions to ask, not answers. Then let the interview do what it is good at: finding out whether someone can do the job. --- ### Best Exa alternatives for AI agents in 2026 *Eight alternatives compared across search, live fetching, browser automation, and cost at volume.* Source: https://www.sixtyfour.ai/blog/best-exa-alternatives Hashim Khawaja · 2026-09-17 · Engineering Sixtyfour runs an investigative research agent. Every run starts the same way: find pages about a person, pull the content down, and carry on when a site refuses to cooperate. So we spend a lot of time thinking about the layer underneath, and we have opinions about who does what well. Exa is a good product. If you want semantic search over a prebuilt index and clean page text handed back in one call, it does that, and the API is pleasant to work with. Teams still leave it, usually for one of four reasons, and which reason you have decides which of the tools below you should look at. #### Why teams look past Exa The index is not the live web. Exa serves results from its own crawl, which is what makes it fast and what makes semantic search work at all. It also means a page published this morning, or a page Exa's crawler never reached, is not there. For a news query or a freshly updated profile, an index lookup and a live fetch give you different answers. Cost climbs with result depth. [Search is $7 per 1,000 requests](https://exa.ai/pricing), covering the first ten results, and every result past ten adds $1 per 1,000. Contents is billed per content type, so asking for text and highlights on one page counts as two. None of this is hidden, and it adds up in a way the sticker price does not suggest once an agent is calling in a loop. Some sites will not serve a crawler at all. News publishers are the obvious case. If the content you need sits behind an aggressive bot defence, an index that could not fetch it cannot hand it to you either. And nothing here logs in. Search and fetch are read-only by definition, so the moment your workflow needs to fill a form, click through a flow, or read something behind a session, you are outside what a retrieval API can do. #### How we picked these Our criterion is the whole chain: find the page, get the content, and where the job demands it, act on the site. We care about coverage of difficult domains, freshness, cost at volume, and whether there is a sane path from a prototype to production traffic. Prices were checked in September 2026. Several of them changed in the past year, so confirm before you budget. #### At a glance | Tool | Its actual job | Published price | Free tier | | --- | --- | --- | --- | | TinyFish | Search, fetch and Web Agent, live browser | Search and fetch $0; Agent $0.016/step; Browser $0.002/min | Yes, rate limited | | Brave Search API | Independent search index | $5 / 1k queries | $5/month credit | | Tavily | Search shaped for RAG | $0.008 / credit | 1,000 credits/month | | Firecrawl | Crawl a site into markdown | $16/month for 5,000 credits | 1,000 credits/month | | Serper | Cheap Google SERP data | About $0.30 to $1 / 1k | 2,500 queries once | | Jina Reader | URL to clean text | Free, then token billed | Yes, generous | | Parallel | Deep research with citations | Search $1 to $5 / 1k; Task $5 to $2,400 / 1k | 5,000 requests/month | | Browserbase | A real browser you drive | $20/month, then $0.12/browser hour | 1 browser hour | | Exa, for reference | Semantic index search | Search $7 / 1k; Contents $1 / 1k pages | $20 credit, $10/month | #### 1. TinyFish Image: exa-alternatives-tinyfish-homepage.jpg | TinyFish homepage | [tinyfish.ai](http://tinyfish.ai/) [TinyFish](https://www.tinyfish.ai/) sits first for us because it is the only tool on this list that covers the whole chain behind one key. Search, Fetch, Agent and Browser are separate endpoints on a single account, and the Agent will work through a multi-step flow on a site, including one that needs a login. The architectural difference from Exa is the one that matters. TinyFish fetches from the source with a real browser at request time, where Exa answers from its index. On a page that changed an hour ago, or a publisher that blocks crawlers, those two approaches do not produce the same result. On TinyFish's own [vendor comparison page](https://www.tinyfish.ai/compare/tinyfish-vs-exa), the company reports 49.2% top-result accuracy versus 38.4% for Exa, 93% fetch coverage versus 73%, and 15 of 15 news publishers reached versus 5 of 15. These are self-reported numbers from a TinyFish-run test set, not an independent benchmark, so treat them as directional rather than conclusive. For a third-party read, the [Artificial Analysis Search Index](https://artificialanalysis.ai/agents/search-api) (data as of Sep 8, 2026) puts TinyFish's search cost at $0 per 1,000 benchmark tasks, the lowest of the 13 providers tracked, including Exa. Search and Fetch are free, which is unusual enough to explain. The published free tier is 30 requests a minute and 500 an hour for Search, and 150 URLs a minute and 1,000 a day for Fetch. Agent runs cost $0.016 a step and Browser sessions $0.002 a minute, both funded from a prepaid wallet with a $10 minimum. Default concurrency is deliberately low, two Agent runs and five Browser sessions, and you raise it by talking to them. In July they released Mako, a web-native model that powers the Agent layer, trained on their own record of agents doing web tasks for customers. This is the one to reach for when your workflow does not stop at reading, or when the sites you need are the ones that fight back. The cost of that is operational. Anything at real volume starts with a conversation rather than a credit card, and the free search and fetch tiers are rate limited enough that you will feel them during a heavy backfill. #### 2. Brave Search API Image: exa-alternatives-brave-search-api-homepage.jpg | Brave Search API homepage | [brave.com/search/api](http://brave.com/search/api) [Brave](https://brave.com/search/api/) runs its own index, built from its own crawler, which puts it in the small group that does not resolve to Google or Bing underneath. Anyone who has watched a SERP reseller change behaviour overnight because their upstream changed knows what that independence is worth. Pricing is $5 per 1,000 queries with a $5 monthly credit, and the rate limit is 50 queries a second, high enough that most people never think about it. There is a separate Answers plan at $4 per 1,000 plus token costs. One clause to read carefully: storing results to train or fine-tune a model needs a plan that specifically grants those rights, and the standard terms do not cover it. If your pipeline retains raw results, settle this before you build on it. Brave suits anyone who wants a plain, fast, independent index with predictable per-query billing. It is search only, though. You get links and snippets, and the page content is your problem. #### 3. Tavily Image: exa-alternatives-tavily-homepage.jpg | Tavily homepage | [tavily.com](http://tavily.com/) [Tavily](https://tavily.com/) is built for retrieval-augmented generation and it shows in the shape of the API. You ask a question and get back results already trimmed to something you can put in a prompt. The free tier is 1,000 credits a month, pay as you go is $0.008 a credit, and a project plan adds higher rate limits. Credits are consumed at different rates by search, extract and crawl, and the pricing page sends you to the docs for the breakdown, which is mildly annoying when you are trying to model cost. It is a good choice when you are building a RAG pipeline and want the search layer to stop being a project. The abstraction that makes it quick to start is the same one you argue with later, when you need to know exactly which sources were consulted and why. #### 4. Firecrawl Image: exa-alternatives-firecrawl-homepage.jpg | Firecrawl homepage | [firecrawl.dev](http://firecrawl.dev/) [Firecrawl](https://www.firecrawl.dev/) turns a site into markdown. Point it at a URL, or at a whole domain, and get back clean text a model can read, with a crawler that handles the tedious parts. The free tier is 1,000 credits a month, Hobby is $16 a month for 5,000 credits, and it runs up to $599 a month for a million. A page scrape is one credit and search is two credits per ten results, while structured JSON extraction adds four credits a page, which is the line item that surprises people. Firecrawl fits when the job is a known set of sites whose content you want, rather than a search problem. Concurrency on the cheap plans is genuinely low, two concurrent requests on free and five on Hobby, so the first serious crawl you run will push you up a tier. #### 5. Serper Image: exa-alternatives-serper-homepage.jpg | Serper homepage | [serper.dev](http://serper.dev/) [Serper](https://serper.dev/) sells Google SERP data, fast and cheaply. It is the least ambitious tool here and that is the appeal. You get what Google returned, in a second or two, without any pretence of being more than that. Billing is prepaid credit packs rather than a subscription, running from roughly $1 per 1,000 queries at the entry pack down to about $0.30 at the largest, with 2,500 free queries to start. One credit covers ten results and going deeper costs two, so if your agent routinely asks for more than ten, budget at double the sticker. Take it when you want raw Google results and nothing else. You are buying links rather than content, and a reseller relationship with whatever sits upstream of them. #### 6. Jina Reader Image: exa-alternatives-jina-reader-product-page.jpg | Jina Reader product page | [jina.ai/reader](http://jina.ai/reader) [Jina Reader](https://jina.ai/reader/) is two endpoints. Put a URL behind [r.jina.ai](http://r.jina.ai/) and get clean text back. Put a query behind [s.jina.ai](http://s.jina.ai/) and get the top results as text. It handles PDFs and will caption images. It works with no API key at all at 20 requests a minute, a free key raises that to 500, and new keys come with 10 million tokens. Billing past that is by output tokens, and search requests carry a fixed 10,000 token minimum whatever comes back. This is the cheapest way we know to turn a URL into something a model can read, and a sensible fallback partway down a chain. It makes no attempt to solve hard fetches, so the sites that block bots will block this too. #### 7. Parallel Image: exa-alternatives-parallel-homepage.jpg | Parallel homepage | [parallel.ai](http://parallel.ai/) [Parallel](https://parallel.ai/) aims at multi-step research that returns citations, which puts it between a search API and an agent. The Task API runs processors at increasing depth, from Lite at $5 per 1,000 requests up to Ultra8x at $2,400 per 1,000 for runs that take eight to thirty minutes. A plainer Search API sits underneath at $1 to $5 per 1,000, with a Turbo processor around 200ms, and there are 5,000 free requests a month. We know Parallel from a second angle, since it appears in [our own people-research benchmark](https://www.sixtyfour.ai/recon-benchmark), where Parallel Ultra 2x scores 41.1% weighted accuracy against Sixtyfour High at 54.3%. That benchmark is ours and it measures people research specifically, so read it as one narrow result rather than a verdict on the product. Parallel earns its place when the unit of work is a research question rather than a query and you need the citations to defend the answer. The deep processors cost enough that you have to be deliberate about which requests deserve one. #### 8. Browserbase Image: exa-alternatives-browserbase-homepage.jpg | Browserbase homepage | [browserbase.com](http://browserbase.com/) [Browserbase](https://www.browserbase.com/) gives you a real browser in the cloud that you drive yourself, with Playwright or Puppeteer or an agent framework on top. It is a different layer from everything above, with no opinion about search, just a browser that someone else keeps alive. The Developer plan is $20 a month with 25 concurrent browsers and 100 browser hours, then $0.12 an hour. Startup is $99 for 100 concurrent and 500 hours. There are Search and Fetch endpoints too, at $7 and $1 per 1,000, which lands in the same place as Exa. Reach for it when you have logic that genuinely needs a browser and would rather not run the fleet yourself. You are writing and maintaining the automation, which is both the point of the thing and its real price. #### What actually breaks at volume Three things, none of which show up while you are prototyping. Concurrency ceilings arrive before price does. Most of these publish a per-minute or per-second limit that is fine for development and too low for a backfill, and raising it is a conversation with a salesperson rather than a settings page. Find your ceiling early, because discovering it during a production run makes for a bad afternoon. Per-result billing changes the shape of your cost. Exa, Serper, Firecrawl and Parallel all price the first ten results differently from the next ninety. An agent that asks for more results when it is uncertain will quietly double its own bill, and you will find that in the invoice rather than in the logs. Coverage is bimodal. A fetch layer does not degrade gracefully across hard sites, it works or it does not, and the sites it fails on are the same ones every time. Test against the twenty domains you actually care about rather than a random sample, because the average tells you very little about your case. #### Frequently asked questions ##### What is the best Exa alternative? It depends which part of Exa you were using. For live fetching, and for anything that needs to act on a site, TinyFish. For plain independent search, Brave. For turning known sites into text, Firecrawl or Jina Reader. For research questions with citations, Parallel. ##### Is Exa expensive? At $7 per 1,000 searches it sits at the higher end for search, and the per-result and per-content-type billing means the effective rate usually lands above the sticker. Whether that is expensive depends on whether the semantic index is doing work for you that a cheaper keyword index would not. ##### What is the difference between a search API and a scraping API? A search API answers "which pages are about this" and gives you links. A scraping or fetch API answers "what does this page say" and gives you content. Exa does both in one call, which is convenient and is also why its billing has two dimensions. Most of the tools here do one of the two well. ##### Can any of these read pages behind a login? Only TinyFish and Browserbase, and they get there differently. TinyFish's Agent handles authenticated multi-step flows as a managed service. Browserbase gives you a browser and you write the flow yourself. Everything else on this list is read-only. ##### Do I need an index or live fetching? An index is faster and cheaper per call and gives you semantic search across pages already crawled. Live fetching is slower and reaches pages an index missed or was blocked from. If freshness or hard domains matter, you want live fetching, possibly with an index in front of it for the easy cases. ##### What if the thing I need from Exa is research on people? None of the tools above solve that on their own. Searching a name returns pages containing that name, which is a weaker claim than establishing that they all describe the same person, and that gap is where most people-research pipelines quietly go wrong. If the job is identity resolution or background research rather than retrieval, you want something built for it. We publish [RECON](https://www.sixtyfour.ai/recon-benchmark), a benchmark for how well agents find long-tail facts about a specific person, which covers the systems that compete on that directly. ##### How do I check whether a result is current? Ask the vendor when the page was fetched, not when it was published. An index will happily return a page it crawled months ago, and the publication date printed on that page tells you nothing about the gap. Tools that fetch at request time do not have this problem. #### What we build Sixtyfour is a people research API. You hand it an identifier, a name, an email address, a company, a profile URL, and it works outward from there across fragmented sources and returns the specific facts you asked for, with provenance attached. Most of the teams using it work in trust and safety, investigations or identity verification. It sits on top of infrastructure like the tools above rather than replacing any of them, which is why we spend so much time comparing them. If that is your problem too, the [RECON benchmark](https://www.sixtyfour.ai/recon-benchmark) is the most useful thing we publish, and there is a [demo](https://www.sixtyfour.ai/demo) if you would rather see it run. --- ### Inside Sixtyfour: how we operate *Twelve principles we actually run on — plus the 120lb flat cart that explains all of them.* Source: https://www.sixtyfour.ai/blog/how-we-operate Justin Young · 2026-09-11 · Company #### General operating principle > 💡 When a customer asks for a watergun, we hand them a bazooka. That's the saying in our office, and it's the closest thing we have to a mission statement for how we work. A customer never asks for the thing they actually need. They ask for the smallest thing they think they can get away with asking for. A CSV. A quick check. "Can you just look at one profile for me." Most companies hand over the watergun. Exactly what was asked, nothing more, ticket closed. We hand over the bazooka. We look at what they're actually trying to do, and we solve that, at a scale and depth they didn't think to ask for. Then they tell their friends. #### The wagon and the flat cart When we moved offices, Saarth needed a little 1-foot wagon to move some boxes. Reasonable ask. Ronin, our Head of Growth, showed up with a 120lb flat cart which he got from his apartment complex 2 miles away. I still don't know how he brought that over to this day. Image: how-we-operate-wagon.jpg | A small folding utility wagon | The 1-foot wagon. The literal ask. Image: how-we-operate-flat-cart.jpg | Two people loading parcels onto a 120lb orange flat cart in the Sixtyfour office | The flat cart. What was actually needed. That's the whole culture in one picture. Nobody told Ronin to do that. He heard "I need to move stuff," skipped the literal request, and solved the actual problem so hard it became a joke. That's high agency. It's the trait we care about more than any other, and every principle below is a version of it. #### How we operate ##### 1st Principle: Our goal is our customers. Everything at Sixtyfour exists to make our customers successful. Not to raise money, not to look cool on X, not to have the smartest agent architecture. Those things are nice. They are not the point. In practice: - When a customer needs something on a Saturday, it gets done on Saturday. Not because there's a policy. Because they need to feel seen, and a customer who feels seen doesn't churn. - When a customer says "this report was insane," it makes the whole team's week. When one churns, it stings for a while. - We would rather over-deliver to 10 customers than under-deliver to 50. We don't enforce this. You can't enforce caring. We hire people who already care and then we get out of their way. ##### 2nd Principle: Bazookas, not waterguns. High agency means you own the outcome, not the task. - You don't wait to be told. You see the gap and you fill it. - You don't do exactly what was asked if you can see the person actually needs something bigger. - You don't say "that's not my job." At a company this size, every job is your job. - You don't stop at the first "no" from a tool, a vendor, or a process. You find another way. The 1-foot wagon is the literal ask. The flat cart is what they actually need. Bring the flat cart. ##### 3rd Principle: We move insanely fast. Fast gets good before good gets fast. - Ship the thing. Get feedback. Fix it. Ship again. A rough answer to a customer in 20 minutes beats a perfect one tomorrow. - Speed is a customer feature. Half of why customers love us is that we respond like we're sitting next to them. - In a fast-moving environment, the cost of waiting is almost always higher than the cost of being wrong and correcting. ##### 4th Principle: Happy customers → happy team → better company. This is the ops flywheel, and it only spins in one direction. Customers happy → they renew, they expand, they tell people. That's revenue and pipeline we didn't have to buy. Team happy → we ship more code, write better content, and work in sync instead of stepping on each other. Morale isn't soft. It shows up in the commit log. Ops sits in the middle of this loop. Half the job is making sure customers feel seen. The other half is making sure the team is fed, unblocked, and not drowning in admin so they can do the work that makes customers happy. Same job, two ends. ##### 5th Principle: We prioritize ruthlessly. You will always have more asks than hours. Every ask gets sorted on two axes: who it's for and how time-sensitive it is. | | Urgent (today / this hour) | Soon (this week) | Whenever (no deadline) | | --- | --- | --- | --- | | Customers | 🔴 Drop everything. Weekends included. | 🟠 Do it today anyway. | 🟡 Batch it, but don't let it sit past the week. | | Prospects | 🟠 Same day. A slow reply is a lost deal. | 🟡 Within 48 hours. | 🟢 When there's a lull. | | Team | 🟠 Unblock them now if it's blocking a customer; otherwise same day. | 🟡 This week. | 🟢 Backlog. | | Investors | 🟡 Same day, but after customers. | 🟢 This week. | ⚪ When it's convenient. | How to read it: - Customers outrank everyone. A customer "whenever" still beats an investor "soon." - Prospects are close behind. A prospect is just a customer we haven't closed yet. - Team asks feel the most urgent because they're the loudest and closest to you. Resist that. Sort them honestly. - Investors matter, but investors are patient. Customers are not. - If two things land in the same cell, the one closer to revenue wins. ##### 6th Principle: Precision with the team. Humanity with customers. Two different modes of communication. Don't mix them up. With teammates: precise and detailed. In a high-stakes, fast-moving environment, vague messages cause fuckups. Minor fuckups incur major losses. Say exactly what, exactly who, exactly by when, and exactly what "done" looks like. Over-communicate context. A message that takes you 30 extra seconds to write can save someone an hour of guessing. With customers: sound like a human. Don't use AI when chatting with customers, or at the very least don't sound like it. There is so much slop out there right now that a real human message with a typo, a "lol," an actual opinion hits completely different. Customers can smell a template. Write like you're texting a friend who happens to pay us. ##### 7th Principle: Ask. Then ask again. Most of my biggest fuckups came from one thing: I didn't ask enough clarifying questions. To a teammate, to a customer, to the CEO. I assumed, I ran, and I built the wrong thing fast. - Ask before you start. "When you say X, do you mean A or B?" costs 30 seconds. Rebuilding costs a day. - Don't be afraid of looking dumb. Nobody remembers the dumb question. Everybody remembers the wrong deliverable. - But be tasteful. There is a point where a dumb question is just a dumb question. If the answer is in Slack, the docs, or the last five minutes of the call, go find it first. - Ask for help before you drown. I once took on too many time-sensitive requests from too many teammates at once, and delivered mediocre work on all of them. Nobody wins in that scenario. If you are sure you can't do something well and on time, say so early. We're a team. Someone will grab it. ##### 8th Principle: Be a sponge. Collect as much context as you possibly can, as fast as you can. Sit in on sales calls. Read every customer thread. Understand the sales cycle end to end: who the buyer is, what they're evaluating, what makes them sign, what makes them stall. Understand the team dynamic: who owns what, who's stretched, who needs what from you. The more context you have, the fewer clarifying questions you need, and the better your instinct gets for when a watergun ask is actually a bazooka ask. ##### 9th Principle: Low ego. Get your hands dirty. No task is below you. Not one. The same person who runs a customer call at 10am is hauling boxes at noon, ordering lunch at 11:30, and cleaning up the kitchen at 6. The Head of Growth dragged a flat cart 2 miles. The CEO takes out the trash. Nobody here thinks their title exempts them from the unglamorous stuff, because the unglamorous stuff is what keeps the company running. - If something needs doing and you're the closest person to it, it's yours. - You can't be afraid to get your hands dirty. Wiping down tables, chasing an invoice, packing boxes, fixing a broken CSV by hand at midnight. All of it counts. - Ego slows everything down. The moment someone decides a task is "not their level," the task sits there and the whole team eats the delay. - Low ego also means taking feedback without flinching. If you're wrong, say so, fix it, move on. The people who go furthest here are the ones who never once asked whether a job was worth their time. They just did it. ##### 10th Principle: We love the untravelled path. Conventions are fine when they work. But that's all they are. Conventions. Look at who's actually on this team. One of our founding engineers dropped out of school to join us when he was 19. Some of us came from research labs. Some of us came from door-to-door sales. Some of us came from making content. A huge chunk of the team are international students who moved across the world to build here. That's not an accident. We hire for unique perspectives, because the obvious path has already been walked by everyone else, and there's nothing left on it. The interesting stuff is off the trail. - If a customer request sounds weird, that's a reason to lean in, not a reason to say no. - If nobody on the team has done something before, great. That means we get to figure it out. - If the "normal" way of doing something is slow or boring, find the abnormal way. A room full of people who took the same path will all see the same things. We'd rather see something new. ##### 11th Principle: We always want more. Nobody here is waiting to be handed a bigger challenge. They go and take one. The pattern at Sixtyfour is that someone finishes what they were hired to do, then shows up asking for the next, harder thing. The ops person starts running sales calls. The engineer starts writing content. The intern starts closing deals. We love this. It's how a small team punches way above its headcount. - Master your lane, then step out of it. - If you're bored, that's a signal to ask for more, not to coast. - The people who grow fastest here are the ones who never think of their job description as a ceiling. - Be an infinite learner. There is always more to want. ##### 12th Principle: We are extremely capital efficient. We don't throw money at problems. We think first. We are a small team with a finite runway, and every dollar and every hour is a bet. A lazy team spends its way out of problems. A strategic team asks whether the problem even needs money, and if it does, what the smallest amount is that gets the answer. This doesn't mean we're cheap. It means we're deliberate. We spend on things that move customers, and we don't spend on things that don't. - Think before you spend. Can this be solved with a message, a workaround, a favor, or an afternoon of work instead of a purchase? Usually yes. Ronin didn't buy a cart. He borrowed one. - Minimum viable tests. Before committing a week, commit an afternoon. Before a big enrichment, run a sample. Before a big event, run a small dinner. - Say no to bad-fit customers. A customer who isn't a fit today costs more to serve than they pay. It's fine to turn them away or park them. - Neglect on purpose. It's normal for parts of the product, the office, or the process to be ugly because we're focused on something that matters more right now. That's a choice, not an oversight. - Go all-in when it counts. Sometimes a thing looks trivial from outside but is the whole deal. When it is, we throw everything at it, money included. Extreme prioritization, minimum viable tests, and thinking before spending. That's how a small company acts like a much bigger one. --- ### Reverse username search: tracing one handle across platforms *Bad actors hide behind pixelated avatars and disposable handles. Here is how the chain unravels.* Source: https://www.sixtyfour.ai/blog/how-we-use-agents-for-reverse-username-search-investigations Hashim Khawaja · 2026-05-16 · Trust & Safety #### Field Brief - Scams starting on social media accounted for the highest total losses at $1.4 billion in 2023. - Trust and safety teams rely on IP bans or device fingerprinting, but operators rotate hardware and VPNs. - Our agents can automate a reverse username search, tracking handle reuse across forgotten forums, dormant Discord servers, and old data to surface real names, locations, and emails in minutes. #### The Anatomy of a Reverse Username Search On platforms like Roblox, which has 78 million daily active users, more than 40 percent of the user base consists of preteens. Because of strict compliance rules, gaming platforms cannot ask children for their real name, email, or phone number at signup. Every user is an anonymous username and a pixelated avatar. Since 2018, only 24 people have been arrested for abusing children they met on that specific platform. The reason predators evade capture is simple. Trust and safety teams ban the IP address. The operator boots up a residential proxy. The platform bans the account. The operator registers a new one. But a username is rarely single-use. The internet is sticky. An operator spinning up a burner account on a gaming platform in 2024 shares behavioral DNA with an account they created on a defunct forum in 2018. They reuse passwords. They leak their own aliases. This behavior scales across organized fraud rings. Account takeover attacks jumped 354% year-over-year in Q2 2023 across Sift's global network. A manual reverse username search relies on an analyst plugging that handle into search engines, deep web databases, and known operator registries. The analyst hopes for a match. It works, but it takes days or weeks of cross-referencing. By the time the analyst links a gaming handle to a known fraud ring, the operator has already extracted the funds or moved to a new target. #### Resolving the Alias to a Real Jurisdiction Finding a real name is only the first phase. The final step of a reverse username search is resolving that identity to a physical jurisdiction and mapping the associated corporate entities. This is highly relevant in marketplace fraud and intellectual property theft. In 2022, federal authorities cracked a massive counterfeit hardware ring. Onur Aksoy, who used the alias “Dave Durden,” ran a massive scheme trafficking over $1 billion in counterfeit Cisco gear through at least 19 companies and dozens of online storefronts. Tracing an alias like “Dave Durden” manually through Amazon seller pages and eBay profiles yields fragmented data. The operator registers storefronts under synthetic identities. > Check out social media, Telegram and everywhere else. The proliferation of advertisements that lure consumers into this rabbit hole of fraud is just getting started. Buckle up. — Frank McKenna, Chief Fraud Strategist, Point Predictive Our agents follow that trail to surface a real name, location, email, and full digital profile from a handle alone. They automate the exact methodology a forensic accountant or federal investigator uses, executing the queries in parallel across thousands of disparate data sources. Instead of a trust and safety team waiting 31 days for a subpoena response to identify a seller, they see the operator's real name and associated shell companies the moment the account flags for suspicious volume. They identify the operator before the funds leave the platform. If our agents can find a predator hiding behind a Roblox username, imagine what the graph can do when you need to research a syndicate targeting your onboarding flow. Full integration docs at [docs.sixtyfour.ai](http://docs.sixtyfour.ai/). --- ### Identity resolution: catching banned users who rotate hardware *Device fingerprinting works on the bottom 90% of operators, but the top 10% rotate hardware before breakfast. Here is how to stop them.* Source: https://www.sixtyfour.ai/blog/how-we-use-agents-for-identity-resolution-on-banned-scammers Saarth Shah · 2026-05-12 · Trust & Safety #### Field Brief - Sift recorded a 354% year-over-year increase in account takeover attacks, driven largely by operators bypassing traditional device fingerprints. - Most trust and safety teams respond by banning the account, but banned scammers return within hours using clean IPs and fresh emails, creating the empty footprint anomaly. - In theory, this can be solved by tracing a single banned username back through old forums, social accounts, and breach data to find the real person. - Our agents do exactly that, cross referencing clear web public records, underground marketplaces, and proprietary databases to map the human behind the keyboard. #### The Account Takeover and Ban Evasion Loop Sift recorded a 354% year-over-year increase in account takeover attacks in Q2 2023. Trust and safety teams ban these compromised accounts daily. The operators simply return the next morning with a clean IP and fresh email address. This creates the empty footprint anomaly. We define this as a signup method with zero historical presence across breaches, social platforms, or public records. A real person has years of digital depth tied to their primary email. They ordered food, bought shoes, and registered for forums. A returning bad actor has an account created 12 hours ago. > What's driving a majority of the fraud risk in the last 12 to 18 months has been the sharing of schemes like credit washing and stolen social security numbers on social media. — Frank McKenna, Chief Fraud Strategist at Point Predictive If a platform relies purely on session telemetry, the attacker already has the playbook to bypass it. #### How to Map Cross Platform Fraud Rings The FBI's Internet Crime Complaint Center reported $12.5 billion in losses across 880,418 complaints in 2023. A massive portion of that volume flows through repeat offenders using burner identities. Real investigations prove that isolated bans do not disrupt these networks. Identity resolution proves exactly how these networks unravel. #### Tracing the Reused Username A marketplace customer banned a top scammer. Twelve hours later, a new applicant appeared. The only mistake the operator made was reusing the same username across niche forums even when he rotated primary emails. The banned username appeared on seven different platforms. One of those matches traced back to a 2016 gaming forum. The operator had posted there using his real first name. That single post connected to a Reddit account listing his home city. The Reddit account led directly to an email exposed in a 2021 breach data dump. That breach record contained his full legal name. The operator thought he was anonymous. He was actually leaving a traceable map. #### How Identity Resolution Works We do not rely on session telemetry or IP geofencing to map these networks. We built an investigative layer that cross references fragmented signals across the internet. ##### The Input Layer Investigators input a single identifier into the platform. This can be an email, a phone number, a Telegram handle, a cryptocurrency wallet, or a marketplace seller ID. Our agents query multiple surfaces in parallel. The system searches Sixtyfour proprietary identity databases, dark web underground mentions, and historical breach records detailing password reuse. It maps social profiles across platforms like LinkedIn, GitHub, Reddit, Steam, and Discord. It pulls clear web public records, including LLC registries, court filings, and marketplace seller pages. ##### Resolving the Graph LLM reasoning weighs the quality of these signals. A phone number surfacing in a 2023 breach record tied to an email represents a high confidence link. That same email appearing in two account rental Telegram groups forms another edge. The output is a clear graph. It shows the connected accounts, the confidence scores for each edge, and the exact platforms the operator uses. #### What This Means for Trust and Safety Stacks Trust and safety teams must adapt their entry gates. Device fingerprinting catches the operator who reuses one phone. It does not catch the operator who buys a $30 burner SIM for each new account. Teams should monitor for the empty footprint anomaly first. It catches the highest confidence synthetic accounts immediately at onboarding. An email with zero history on GitHub, Reddit, or historical breaches is rarely a high value customer. In 2023, FinCEN issued advisories explicitly noting that state sponsored actors, including the Lazarus Group, exploit weak onboarding checks to launder funds. Stopping these actors requires looking past the device. Second, teams must implement identity resolution on banned operators to understand the blast radius. If you do not map the entire network, banning one account just forces the operator to switch tabs. The goal is removing the human behind the keyboard, not just burning their current alias. --- ### How to detect rented gig-worker accounts *A $65 Facebook transaction is all it takes to put an unvetted stranger behind the wheel. Here's how Sixtyfour closes that gap.* Source: https://www.sixtyfour.ai/blog/how-we-use-agents-to-detect-rented-gig-worker-accounts Hashim Khawaja · 2026-05-08 · Trust & Safety The app said a woman was delivering her food. A man showed up. He had paid $65 for that account on a Facebook group. This is what a verification gap looks like in the real world. #### The Problem - The February 2025 Wilbraham, MA Uber Eats assault was committed by a man using a rented account registered to a woman. - 1 in 4 gig workers has rented or sold their verified account; this rises to nearly 1 in 3 for Millennial and Gen Z drivers. - Standard KYC and background checks at signup miss this completely. The problem is a failure of continuous identity verification, not onboarding. #### The Gig Economy's Continuous Identity Problem Every major gig platform runs background checks. The accounts are legitimate. The people who passed are real. The issue is what happens after verification. These accounts are openly traded in private Facebook groups and Telegram channels for anywhere from $65 to over $400 a month. The platform recognizes a valid account ID, but the trust-and-safety team is unaware of the transaction that put an unvetted person behind the wheel. #### How We Trace the Real Person ##### The Input: A Flagged Account An investigation starts with a driver account for "Sarah L." Flagged for a sudden spike in negative reviews and trips running 18 hours a day. The only hard data point: her phone number. ##### The First Trace: Anchoring the Real Owner Our agent cross-references the phone number against our identity graph, breach data, and public social profiles. Within seconds: LinkedIn, GitHub, forum usernames, and two breach records — all linking back to the same person. ##### The Second Trace: Surfacing the Renter The device ID logging trips is an Android model Sarah has never used. Trip origins are 60 miles from her address. Active hours don't align with her social posts. Our agent finds the renter on a dark web forum using a password fragment from one of Sarah's old breaches. #### How Identity Resolution Differs From Standard KYC Traditional KYC answers one question: is this person who they say they are right now? Our agents answer a different one: who is this person, everywhere? 1. The Input — A single flagged identifier: email, phone, username, crypto wallet, or name. 2. The Search — Cross-referenced across Sixtyfour's proprietary databases, dark web sources, breach records, social profiles, and public records. 3. The Resolution — An LLM-driven inference layer weighs signal quality and maps resolved entities into a unified graph. 4. The Output — A graph of connected accounts with confidence scores. Not a single data point — a complete picture. 5. What We Don't Do — No IP-based ID, no device fingerprinting, no private platform data, no legal determinations. --- ### Beneficial ownership: tracing who is behind a shell company *In 2024, TD Bank pleaded guilty to $18.3 trillion in unmonitored transaction activity tied to money laundering. Here is how agents trace the beneficial owners behind shell networks.* Source: https://www.sixtyfour.ai/blog/how-we-trace-hidden-beneficial-owners-behind-shell-companies Roham Mehrabi · 2026-05-05 · Trust & Safety In 2024, TD Bank pleaded guilty to $18.3 trillion in unmonitored transaction activity tied to money laundering, and here is how to trace the beneficial owners behind the shell networks using agents. #### Field Brief - FinCEN reported the United States loses approximately $70 billion annually to shell company exploitation, masking illicit funds behind layered LLCs and nominee directors. - Most compliance teams pull the corporate registration, find a law firm address or nominee name, and hit a dead end when the real owner does not appear on the paper. - Stopping the flow requires tracing the digital footprint of the formation email, the shared registered agent, and cross-platform public records to find the human controller. - We use our agents to cross reference entity names against breach data, court filings, and public registries to map the hidden human network in minutes. #### The AML Compliance Gap in Shell Company Detection In 2024, the United States Department of Justice forced TD Bank to plead guilty to Bank Secrecy Act violations. The institution failed to monitor $18.3 trillion in transaction activity over six years. Much of this unmonitored flow moved through layered corporate entities designed specifically to obscure the beneficial owner. We call the primary evasion tactic the shell-LLC chain. We define this as multiple LLCs registered to the same agent address, identifying coordinated networks rather than isolated businesses. A second pattern is nominee shielding, where an operator uses a localized registered attorney to sign formation documents while the controller remains completely off the record. > The current patchwork of AML/CFT requirements creates regulatory gaps that criminals and foreign adversaries exploit to launder money, hide illicit wealth, and compromise American innovation. — Andrea Gacki, Director at FinCEN #### How to Map Beneficial Owners in AML Investigations Consider the DOJ findings in the Onur Aksoy counterfeit ring. The operator controlled at least 15 different shell entities. Each entity shielded a portion of the fraudulent Cisco network from direct attribution. When investigators shut down one LLC, another absorbed the volume immediately. The human operator never used his real name on the initial Amazon seller applications. Instead, investigators found an email address tied to a formation document. That email had surfaced in a 2018 data breach. Cross referencing the compromised email pulled up a specific burner phone number. That same phone number appeared on a completely separate domain registration two years prior. The domain registration included a physical address. That physical address matched the registered agent for four additional LLCs operating in the exact same marketplace. The network collapses when you map the human history behind the entity. A shell company is an abstract legal wrapper, but a human operator leaves a permanent digital footprint. #### Finding the Real Person Behind a Shell LLC in 2026 Here is how our agents resolve the network. The input is a single piece of evidence. Investigators can often start with just an entity name, a formation email, a phone number, or a law firm address. ##### The Search Surfaces We query Sixtyfour proprietary identity databases, dark web sources, and underground marketplace mentions in parallel. We check breach records for compromised emails, phones, and password reuse. We scan social profiles across LinkedIn, GitHub, Reddit, and Telegram memberships. We pull clear web public records including LLC registries, court filings, and news mentions. ##### Resolving the Graph A flagged phone number surfaces in a 2023 breach record tied to an email. The same email is the registered owner of two other corporate entities under different names. The output returns a mapped visual of connected accounts, confidence scores per edge, and the exact surfaced identifiers linking them. #### The Future of AML Tools and Corporate Entity Structures As FinCEN rolls out stricter beneficial ownership reporting, operators will rely even more heavily on synthetic identities and dark web nominee rentals. The institutions that survive the next decade of enforcement will not be the ones that collect the most corporate formation documents. They will be the ones that can accurately trace the single human operator hiding behind the paper. --- ### Sixtyfour AI is now backed by Y Combinator *Sixtyfour AI is joining Y Combinator’s first-ever spring batch as we go all in on building the best AI research platform in the world.* Source: https://www.sixtyfour.ai/blog/sixtyfour-ai-is-now-backed-by-y-combinator Saarth Shah · 2025-04-02 · Company #### What is Y Combinator? Y Combinator is the world’s most selective startup accelerator, with an acceptance rate under 1%. Since 2005, YC has funded over 5,000 companies—including Airbnb, Dropbox, Stripe, and Coinbase—whose combined portfolio valuation now exceeds $800 billion. But YC’s real power is in the community. The alumni network is one of the strongest out there, filled with some of the most ambitious and impactful founders in the world. #### What YC Means to Us Between the two of us, Chris and I had applied to YC 10 times. We were always close—never quite made it. I first applied as a freshman in college, full of energy but nowhere near ready. I actually heard about YC back in middle school in India. To me, it symbolized the American Dream. Over the years, we tried dozens of ideas, worked at YC companies, and kept learning. We never gave up, even when it felt like we were always one step away. This time, it just clicked and we are beyond excited to be part of YC’s first-ever spring batch. #### How Sixtyfour AI Started Sixtyfour started like most good ideas do—half out of frustration, half out of curiosity. It was January. I was at Whatnot (YC W20), and Chris had just taken time off from school. We’d both built startups before, and we knew how painful customer discovery was. Identifying the right leads felt broken. So much of it relied on tedious, manual research. We had a hunch: what if we could automate that grind? On our very first call, one of our friends—a founder at a VC-backed startup—paid us to help them find individual psychiatrists in specific geographies. That’s when it clicked: tools like Apollo and ZoomInfo didn’t have solid data on niche, local businesses. Building those lead lists meant scraping directories and manually verifying info online. So we hacked together a prototype that could run “deep research” on any business or person—pulling together everything publicly available. It worked. Within weeks, we helped that customer generate ~$5,000 in new revenue, with only $300 in costs on our end. We weren’t making money yet, but the signal was clear: this was valuable. From there, we started aiming higher—going after companies with larger deal sizes and more complex workflows. That’s where our product really shines. Right around then, the YC interview email landed—midway through a customer call. Twelve hours later, Chris had flown in from Texas and was crashing on my floor in Berkeley. We walked out of the interview thinking we bombed it. Two days later, we were apartment-hunting in San Francisco, and I had submitted my resignation at Whatnot. We were in. #### The Road Ahead Now with YC behind us, we’re going all in on building the best AI Research platform in the world. It started with an enrichment API. Today, it’s become a full-blown research engine that can surface intel on nearly any person or business. We might be the only platform that can reliably identify tiny, obscure businesses—ones with just a couple employees in some corner of the world—and pull up real, actionable contact info. If it exists online, we can find it. In the last two months alone, we’ve grown revenue 20x. But more importantly, we’re generating serious pipeline for our customers—and seeing even more value being built on top of our API. And that’s just the beginning. One use case we’re especially hyped about: finding every customer of legacy software companies. With vertical AI startups rapidly disrupting these niches, that data is turning out to be gold. If that’s something you’re working on, we’d love to talk. #### Thank You We wouldn’t be here without the early believers—our first customers, friends, and mentors who took a bet on us when all we had was a scrappy prototype and a strong conviction. We’re still that same team, two founders who just wanted to build something useful—something people want and love. And we’re more excited than ever. Thank you to everyone who’s been part of the journey so far. We’re just getting started. #### Building something that needs better sales intelligence? We’d love to help—reach out here or DM me on Twitter. --- ## Solutions ### Financial Crime https://www.sixtyfour.ai/solutions/financial-institutions Follow the business. Find the people behind it. Go deeper on the customers that need a closer look. Connect a business to its owners, its online footprint and the evidence your team needs to review. A registry entry is only the beginning. A registered business can still leave important questions unanswered. Does its online activity support what it says it does? Who is connected to it? Which adverse findings actually refer to the same subject? Sixtyfour researches across sources so analysts can work from a fuller picture. #### KYB investigations Research an unfamiliar merchant’s operating footprint and connected people when the application needs more context. #### Beneficial ownership research Follow ownership and directorship records across entities, with the source behind each connection. #### Enhanced due diligence Bring public records, adverse media and unresolved questions together for a deeper customer review. The relationship matters. So does the source. Give reviewers the underlying record, the reason it may relate to the subject and the questions that remain open. Sixtyfour adds investigative context to your existing screening and case review process. #### Where does Sixtyfour fit in our KYB workflow? Use it when a business or connected person needs deeper research. Start with the identifiers you already have, investigate the open questions, then review the cited findings alongside your existing checks. #### Can analysts inspect the evidence? The research is source-cited, so reviewers can examine the records behind findings. Identity matches and incomplete information still need analyst judgment. #### Is this transaction monitoring or a complete AML system? This page describes identity and company investigation. Discuss your existing screening, monitoring and case-management tools with us so we can show where Sixtyfour fits. ### Workforce Risk https://www.sixtyfour.ai/solutions/workforce-identity Know who’s behind the application. A convincing résumé is a starting point. Research the identity behind it, compare the claims with public evidence, and give your team better questions before the interview. The interview starts after the identity story. A constructed identity can arrive with polished credentials and a confident interview. Research the professional footprint behind the application: when it appeared, what corroborates it, and where the story conflicts. A missing record is a question to resolve, not a verdict. #### Candidate fraud research Investigate identity inconsistencies and fabricated history before investing more time in an application. #### Contractor verification Understand the person behind a contractor profile using the identifiers and claims your team already has. #### Platform integrity Research suspicious overlaps between worker profiles and investigate possible identity reuse. Already part of the hiring conversation. Casco uses Sixtyfour to flag adverse media and résumé inaccuracies before getting on a call. The workflow starts with research that hiring and security teams can review together. #### Does a limited online presence mean a candidate is fake? No. Privacy choices, career changes and uneven source coverage can all produce a limited footprint. Missing evidence should remain unresolved and be considered with other information and the candidate’s explanation. #### Does this replace employment background screening? Sixtyfour provides identity research and supporting evidence. Use it within your established hiring review process, alongside any required screening, consent and candidate review procedures. #### Can we investigate contractors as well as employees? Yes. The research can start from a contractor’s known identifiers and professional claims. Our team can help map the output to the questions your reviewers need answered. ### Threat Investigations https://www.sixtyfour.ai/solutions/investigations Start with a lead. See where it connects. Resolve the identity behind an identifier. Research aliases, public records and connected entities, then follow the evidence into the next question. A lead rarely arrives as a complete profile. An investigation might begin with a username, an email address or a company mentioned in a report. Sixtyfour researches across sources and organizes the relevant identities and connections, giving investigators a starting point they can inspect and build on. #### Identity resolution Research the person or entity behind a partial identifier, with evidence for possible matches. #### Relationship mapping Explore links between aliases, companies and records to identify connections worth investigating. #### Case development Bring new leads into an existing investigation and keep the underlying source context close to the finding. Every connection should invite inspection. A graph is useful when you can explain its edges. Sixtyfour pairs identity research with source context so investigators can distinguish a direct link, a possible match and a question that remains open. #### What can an investigation start from? Start with a known identifier such as a name, email address, phone number, username or company. Adding reliable context helps distinguish the subject from similar matches. #### Are all discovered connections confirmed? No. Shared names and reused handles can produce false matches. Inspect the supporting evidence and treat ambiguous links as leads until corroborated. #### Does Sixtyfour make a determination of criminal activity? No. The research supports investigators by surfacing evidence and possible connections. Determinations and further investigative steps remain with the responsible team. ### Research API https://www.sixtyfour.ai/solutions/research-api Your questions. Our research. One API. Define the fields your product needs. Sixtyfour researches people and companies and returns structured findings for your workflows. Ask for the fields your workflow actually needs. Fixed datasets answer the questions someone else chose. Sixtyfour lets you define a research schema for a person or company, so you can request the context your product needs and receive it in a structured response. #### People intelligence Research professional history, public profiles and other requested attributes from a known identity. #### Company intelligence Investigate a business and the people connected to it using a custom research schema. #### Async & bulk research Run longer jobs asynchronously or process batches through the documented bulk endpoints. A small request. A specific research brief. The schema is the brief. Replace the subject and field descriptions with the information your workflow needs. Keep your API key on your server. #### Is the schema fixed? No. The struct object describes the fields you want the agents to research. Write clear descriptions for each field and validate the response in your application. #### How do I choose a research tier? The API supports different research depths. Start with the documented default and compare results on representative subjects. Higher tiers perform deeper research; high-tier intelligence requires enterprise access. See the docs for current access and pricing. #### Can I process a batch of records? Yes. Dedicated bulk intelligence endpoints accept CSV, JSON and NDJSON uploads. They return a task identifier so your application can track the background job. #### Where should I put my API key? Make authenticated calls from your server. Do not embed the key in client-side JavaScript or public repositories. The quick start documents the x-api-key header. --- ## Security https://www.sixtyfour.ai/security Security you can verify Sixtyfour is SOC 2 Type 2 compliant. Our controls protect the data you send us, the platform that runs your research, and the people that research is about. ### Platform security #### Encrypted in transit and at rest Your data travels over TLS, and our production databases are encrypted at rest with AES-256. #### Backed up every day We back up production databases daily and test restoring them twice a year. #### MFA on privileged access Multi-factor authentication is enforced on every privileged account and on access to critical systems. #### Least privilege by default Each role gets the minimum access it needs, and we review access rights every quarter. #### Traceable production access Every connection to production uses a uniquely identified account over SSH, TLS or VPN. #### Penetration tested every year An external firm penetration tests our production environment at least once a year. ### Responsible data #### What we collect: public sources only We collect professional data only from publicly accessible sources. #### How we use it: never for training Your data is used to deliver the service you asked for. We do not use it to train AI models. #### How long we keep it: 12 months at most Every profile we collect is deleted within 12 months of collection. #### Who can ask: anyone Anyone can send a privacy request about their personal data through our compliance portal and follow its progress. ### Documents In the compliance portal (https://compliance.sixtyfour.ai/en). Public documents open straight away; the rest are shared on request. - SOC 2 Type 2 report (on request): The independent audit of our security controls. https://compliance.sixtyfour.ai/en/documents - Data processing agreement (on request): Our template DPA, ready for your legal review. https://compliance.sixtyfour.ai/en/documents - Subprocessors (public): The services that process data on our behalf, and where. https://compliance.sixtyfour.ai/en/subprocessors - Privacy policy (public): How we collect, use and protect personal data. https://compliance.sixtyfour.ai/en/documents/privacy - Security policies (on request): Access control; Asset management; Business continuity, backup and recovery; Code of conduct; Cookies and tracking technologies; Data management; Human resource security; Information security; Operations security; Risk management; Secure development; Third-party. ### Reporting a vulnerability Email security@sixtyfour.ai with the details and the steps to reproduce it.