How to Verify a Company Is Legitimate in 2026

Reported losses to government and business impersonators exceeded $1.1 billion in 2023, more than three times the roughly $310 million reported in 2020, according to the FTC impersonation data spotlight. The same year the FTC logged more than 330,000 business-impersonation reports and nearly 160,000 government-impersonation reports. Together those categories were 48% of fraud reports made directly to the FTC. Bank transfers were about 40% of the reported losses, and cryptocurrency about 21%.

A polished logo did none of that damage on its own. Someone copied a real organization, and a candidate, vendor, or applicant trusted the copy.

Why a Familiar Logo Is Not Proof

You are in Mexico City, São Paulo, Buenos Aires, Bogotá, Santiago, or Lima. A recruiter message offers a remote, hybrid, or on-site role. The name is one you have seen in the news. The site loads on a phone. That is the moment people skip the only question that matters: is this the company, or someone wearing its clothes?

Legitimate means four facts, and all four have to hold at once.

• The legal entity exists. You can find the exact name, number, and active status in a registry you opened yourself.
• The person represents it. HR, finance, or compliance confirms them on a phone number or email you found, not one pasted into the pitch.
• The vacancy is on a channel you found. The careers page, or a listing that sends you to the company's own application flow, matches the text in the message.
• The process never asks for money or control of your computer. No fee, no crypto, no gift card, no remote-control tool, no login to your current employer's systems.

Miss one fact and you stop. A famous brand doesn't fill the gap. Impersonators copy real organizations because a known name gets the reply that an invented name never would. Companies such as Mercado Libre, Nubank, and Rappi post jobs regularly on LATOjobs. A message that borrows a name like that still has to survive the same four facts. The posting history of a real employer is not a free pass for whoever writes you on WhatsApp.

What you confirm before you reply

Treat urgent payment requests, odd payment methods, and early demands for identity documents as warning signs, not paperwork. Confirm the legal company name, a physical or registered presence, domain ownership, and registration through a government or regulatory database. Then contact the organization with details you found independently.

A website, an email signature, or a social profile is not authentication.

That is the whole standard for how to verify a company is legitimate. The scan below tells you when to stop. The steps after it tell you how to confirm the employer before a document leaves your hands. The interview and the money each have their own hard lines.

Signals and Payment Rules

Read this before you send a CV, a passport scan, or a bank letter. Each row is a continue or a stop. If a row isn't a clear stop, it still isn't a yes. It only earns a place in the out-of-band checks that follow. One failed row ends the process.

CheckContinue ifStop ifEmail and domainAddress matches the official domain character for characterFree webmail, look-alike spelling, or swapped Unicode lettersCareers pageThe same role is on the site you found by searching the company nameRecruiter says the opening is secret or only in their messageWho paysThe company pays you and any agency is paid by the employerUpfront fee for the job, training, admin, or equipmentHow money movesSalary by normal payroll after you startCrypto, gift cards, payment apps, or a check you must deposit and forwardIdentity documentsRequested after a written offer that HR confirmedPassport, government ID, or bank login before the role is confirmedInterview accessVideo link comes from the official domainExtension, remote-control tool, or unknown test executableContract and beneficiaryLegal name, pay, governing law, and bank name match the registryBeneficiary is a person or a different companyRegistry recordExact legal name, number, and active status in the right country registryNo record, a mismatched name, or only a certificate the recruiter sentPace and payment changesThey answer questions and keep the original pay pathThey rush you, or the bank details change mid-process

Find the company without using their links

The FTC's guidance on spotting job scams is blunt. Contact the company through a phone number or website you already know is legitimate, and check whether the opening appears on the company's own channels. Type the name into a browser. Open the domain you find, not the one in the email. Compare the careers text with the recruiter's description. If the company can't confirm the role, the person, or the hiring steps, stop sharing documents and treat the offer as unverified.

That check matters in Mexico City, São Paulo, Buenos Aires, Bogotá, Santiago, and Lima because copied branding travels easily in email and messaging apps. Search the company name and the recruiter's name with scam, review, and complaint. A clean search isn't proof. A stack of matching complaints is a stop.

Platform visibility isn't authentication either. Impersonation shows up in text, phone, email, social feeds, and search results. A result on the first page only proves someone paid for attention or copied a page that ranks.

Money rules that don't bend

A real employer doesn't charge you for the job, the laptop, the training, or an "administrative" fee. The FTC's warning on employment-scam invoices describes the pattern. A recruiter sends a fake invoice for a computer or other equipment, tells you to pay first through Cash App, Zelle, or PayPal, and promises a reimbursement that never arrives.

The check version is worse. They mail or email a check, tell you to deposit it, then tell you to forward part of the money by wire, cryptocurrency, gift card, or a payment app. The deposit can be reversed. You are left owing the bank.

Apply that rule the same way in every city and contract type.

On site in São Paulo or Bogotá. An office address and a local brand don't make an equipment invoice legitimate. Decline it. Don't buy gear from a vendor the unknown recruiter picked.

Remote from Buenos Aires or Lima. A home-office stipend that you must prepay, then "get back," is the same invoice with a different label. Payroll after you start is the normal path. Crypto and gift cards are not payroll.

A nearshore contract with a U.S. or European company. Cross-border doesn't create a special fee. The hiring company pays you. If a recruiting firm is in the middle, that firm is paid by the employer, not by you.

Practical rule: If they need your money before you have done a day of work, the offer is finished.

Two edge cases close the scan. A real company name with a fake recruiter is still a stop. Attackers borrow the brand and invent the person. And urgency, or a payment instruction that changes after you asked a question, outweighs bad grammar. Clean English and a high USD number are easy to fake. A sudden new beneficiary is the tell.

How to Confirm the Employer Before You Share Anything

The FBI's account of job-seeker scams reported 24,688 employment-scam victimization complaints and nearly $363 million in reported losses in 2025. Do this before you share an ID or accept funds. A polished site, a LinkedIn profile, testimonials, or a registration certificate the recruiter attached prove nothing.

Work the steps in order. Each one has a pass and a stop.

1. Search the name and open the domain you find. Compare the sender's address character by character with that official domain, including letters that look identical and aren't. Check when the domain was registered, whether mail and the website resolve to the same organization, and whether the certificate names the company. Pass: the address matches exactly and the domain has a history that fits the company. Stop: free webmail, one swapped character, or a domain registered weeks ago under a well-known name.

2. Match the job text to the official careers page. If you saw the role on the platform, remember what Apply does. When you click Apply on LATOjobs, you go straight to the company's own application page. That page is a comparison point, not proof the recruiter is real. Pass: the duties, location, and level line up. Stop: they say the opening is confidential and lives only in their message.

3. Look up the exact legal name in the registry for the country they claim, and write down the number, address, and status. A certificate they emailed you doesn't count. Open the registry yourself. Pass: exact name, active status, and an address you can reconcile. Stop: no record, a near-miss name, or a dissolved entity.

4. Call or email only with a number or address from that official site or from a government filing. Ask HR, finance, or compliance to confirm the person, the role, and the process. Pass: they know the recruiter and the opening. Stop: the only number you have came from the pitch, or they refuse a corporate email or a video confirmation.

5. Search the company and the recruiter with scam, review, and complaint. Pass: nothing that matches this offer's payment pattern. Stop: repeated reports of fees, fake checks, or look-alike domains.

6. Require a written offer that names the legal counterparty, the pay, the governing law, and the payment instructions. The bank beneficiary must match the registered entity. Pass: the names line up. Stop: the beneficiary is a person, a different company, or a detail that changed after you pushed back.

For a U.S. or European employer hiring in Bogotá, the same call still applies. Cross-border onboarding can be genuine. It doesn't get to skip the out-of-band confirmation. Guides such as SOSfinder company legitimacy checks are useful once you already have the legal name, because they walk through registry habits. They don't replace the phone call to HR.

You can also compare what the employer publishes on its own site with the company pages candidates can open directly. Use those pages as context after the registry matches, not as a substitute for the call.

Where to confirm the legal entity

Where the company claims to beRegistry to open yourselfRecord should showMexicoSIGER and Registro Público de ComercioExact legal name, folio and active statusBrazilReceita Federal CNPJ and state Junta ComercialActive CNPJ, address and activityArgentinaIGJ or provincial registry, plus AFIPEntity type, CUIT and domicileColombiaRUES via Cámara de ComercioNIT, mercantile registration and legal representativeChileRegistro de Empresas y Sociedades and SIIRUT and company statusPeruSUNARP and SUNATRUC, legal name and addressUnited States or EuropeThat country's company or state registryExact legal name, status and officers

Stop if they refuse corporate email or video confirmation, pressure you to act today, or change payment details. Urgency and a redirected payment are stronger signals than awkward grammar.

A short walk-through of the same habit, searching the name yourself before you reply, is here:

When the Interview Is the Scam

Poor grammar, a personal Gmail address, and a salary that sounds absurd used to be the whole checklist. Those clues are weaker now. A real company name, a finished website, and a recruiter profile that looks authentic can all be borrowed. Clean speech can be borrowed too.

The FBI's 2025 Internet Crime Report identifies voice spoofing and possible voice deepfakes in online employment scams. Reported losses from AI-involved employment scams reached almost $13 million. Some of those schemes weren't chasing an immediate payment. They wanted access to private computer networks.

A nearshore round that asks for your machine

Say you are in Lima or Mexico City and you join a video round for a nearshore software role. The calendar link didn't come from the domain you already verified. The face and the audio don't quite match. Lip movement lags, or the voice stays smooth while the mouth doesn't. Then the "test" asks you to install a browser extension, a remote-control tool, or an unknown executable. Sometimes they want you logged into a personal cloud account, or into the systems of the employer you already have.

Leave. That isn't a coding exercise. It's an access request dressed as hiring.

The checks that belong on the call are narrow:

• Confirm the meeting through the official domain you already checked, before you click.
• Watch the picture and the sound. Inconsistent lip movement or a voice that doesn't sit with the face is a reason to pause, not a reason to be polite and continue.
• Refuse anything that controls your machine. No extension, no remote desktop, no mystery test file.
• Don't log into personal accounts or your current employer's systems for a stranger's exercise.
• Send offer documents to a separate corporate contact you found yourself, and ask them to confirm the paper.

A practical list of warning signs of fake recruiters is worth reading before you treat a video round as the moment you relax. Pair it with the job-search habits you already use for salary and role fit. Neither replaces the domain check on the meeting link.

Paperwork after a real offer is different

Normal cross-border onboarding asks for tax forms or identity documents after a verified offer, on a channel HR already confirmed. That is not the same as a request, before any confirmed offer, for bank details, a government ID, a crypto payment, or system access. Early banking and early ID are stops. Post-offer tax paperwork, on the channel you verified, can continue.

If the interview needs access to your computer before you have an offer, leave the call.

Walk Away or Continue With the Offer

Continue only if the legal name matches a live registry record, HR confirmed the person and the role on a channel you found yourself, and nobody has asked for money, early banking access, or control of your computer.

Walk away if any one of those fails. A famous brand doesn't override a failed check. A salary that looks high for a junior remote role doesn't either. An unusually high USD figure is a reason to rerun the checks, not a reason to skip them.

Don't treat a listing as proof. LatoJobs offers transparent salary data, detailed company profiles, and one-click applications, and some postings are imported from public sources or APIs. The platform doesn't guarantee their accuracy, completeness, or availability. Use a company profile and a disclosed salary as context after the employer is confirmed. They are not a substitute for the call to HR.

If this offer fails, search current openings by country and run the same four facts on the next message. Start with roles listed by country, including software openings tied to Argentina or Brazil, and read the hiring notes on the platform before you reply to anyone new. The habit is the same every time. Find the domain yourself. Match the person. Match the money to the registered name.

One failed check is enough to stop sharing documents.

LatoJobs is a job marketplace for professionals in Mexico, Brazil, Argentina, Colombia, Chile, Peru, and beyond, with salary details when employers disclose them and company profiles you can read after you have confirmed the employer yourself. Use that context on your next search, and keep the registry check and the out-of-band call in front of every document you send. Visit LatoJobs to browse current openings and compare the company on your own terms.