How do you vet a new client before accepting their first high-value payment?

You vet a new client before a large first payment by confirming who they legally are, checking that the money behind the deal is real and reachable, and never delivering the work or the goods until the payment has fully settled. The goal is not to catch a liar in the act; it is to make sure that if something is wrong, you find out before you have shipped, built, or signed anything irreversible.

A first-time client with no track record is not automatically a risk. Most are exactly who they say they are. But the deals that go wrong rarely look wrong at the start — they look like an unusually enthusiastic buyer, a slightly rushed timeline, or a company whose name is one letter off from a real one. The checks below exist to catch that one deal in a hundred before it costs you the hundred that were fine.

What does basic identity verification look like for a business client?

Basic identity verification means confirming the entity on the contract is a real, registered business with a traceable paper trail, not just a name on an email signature. Start with the company's registration: in the United States, look it up in the state's Secretary of State business registry, which is free and shows the entity's legal name, formation date, and registered agent. In the United Kingdom, Companies House provides the same for a nominal or no fee. A company that was formed a week ago is not automatically fraudulent — plenty of legitimate startups are new — but it changes how much weight you put on other signals.

Cross-check the company name and address against what's printed on the invoice, the contract, and the payment instructions. A mismatch between the legal entity name and the name on the wire details is one of the most consistent markers in business email compromise cases, where a fraudster inserts themselves into an otherwise real negotiation and redirects the final payment to a different account. Confirm the person you're dealing with is actually employed there: a call to the company's main published phone number — not a number given to you in the deal correspondence — asking to be transferred to that person is a five-minute check that closes off a large share of impersonation attempts.

How do you check a company's payment history before dealing with them?

You check payment history by asking for trade references, searching for the company in commercial credit databases, and looking for a pattern of on-time payment with other vendors. A trade reference is simply another supplier who has already been paid by this client — ask the client for two or three, and actually call them rather than just collecting names. For a company above a certain size, a commercial credit report from a bureau such as Dun & Bradstreet, Experian Business, or Creditsafe gives a payment-behavior score built from real supplier data, not self-reported information.

For a smaller company or an individual, payment history is thinner, so weight shifts to indirect signals: how long the business has operated, whether it has a working website and a real physical address (not just a mailbox service), and whether its public footprint — reviews, press, LinkedIn activity — is consistent with the size of the deal it is proposing. A company offering a six-figure payment with no employees listed anywhere, no reviews, and a website registered the same month is not disqualified by any single fact, but the combination is worth a direct conversation before you proceed.

What does it mean to confirm a client's funds before you deliver?

Confirming funds means getting evidence that the money for the deal exists and is reachable before you hand over goods, release work, or treat the deal as done — not just a promise that it will arrive. For a bank-funded deal, this can mean a proof-of-funds letter from the client's bank (see the companion piece on verifying one of those is real, since a fabricated proof-of-funds letter is itself a common scam vector). For a crypto-funded deal, it can mean checking that the wallet address the client plans to pay from actually holds a balance at or above the deal amount — visible on any public block explorer, with no need to ask the client to prove anything.

The safest version of this check is structural rather than evidentiary: instead of asking the client to prove they have the money, build the deal so the money moves before anything else does. A payment router that requires every party's share to be signed off before the client can even submit the payment, and that only releases funds to recipients once the payment has fully settled onchain, removes the need to trust a document at all — the payment is the proof.

What are the red flags that a new client's first payment deserves extra scrutiny?

A handful of patterns show up disproportionately often in deals that later turn out to be fraudulent, and none of them is proof on its own — but two or more together is a reason to slow down.

Any one of these can have an innocent explanation — a real client really might be in a hurry. The point of the table is to flag when to actually run the checks above rather than skip them because the relationship feels friendly.

What does a practical verification checklist look like in under an hour?

A full due-diligence file can take days to assemble, but the checks that catch the overwhelming majority of problems fit into a single short session once you know the order to run them in.

How does this play out when a step gets skipped?

Call her Priya, a freelance brand consultant who took on a new client for a $28,000 rebrand project. The client was responsive, paid a deposit on time, and the work went smoothly — until the final invoice arrived, and new payment instructions came in in the same email thread two days before it was due, citing a bank "migration." Priya wired the balance to the new account without a callback, because the thread looked identical to every other message in the engagement. The funds were gone within hours, routed through several accounts before the bank could act. The deal itself had been entirely real; the only thing that was fraudulent was the one email replacing one set of account digits with another, inserted by someone who had been quietly reading the thread for weeks.

The lesson is not that Priya was careless — the email was a convincing copy of a message the client had actually sent for the deposit. It's that the single habit of confirming payment details through a channel the fraudster doesn't control (a phone call to a known number, not a reply to the same thread) would have caught the swap before the money moved. That habit costs five minutes and nothing else in the relationship changes.

How do you vet a client when they're overseas and you can't easily call them?

Cross-border clients remove the easiest verification tool — the phone callback to a known number — so more weight falls on documentary checks. Most countries maintain a public or low-cost company registry equivalent to a US Secretary of State filing: Companies House in the United Kingdom, the Handelsregister in Germany, ACRA in Singapore, and similar bodies elsewhere, all searchable online and all showing the registered entity, its directors, and its filing history. Cross-reference the company's claimed address against that registry rather than against whatever is printed on an invoice, which is trivial to fabricate.

For a client in a country where business registries are harder to search, lean more heavily on trade references and on video calls rather than text-only correspondence — seeing the person you're dealing with, in a setting consistent with the business they describe, is a weaker check than a registry lookup but still meaningfully better than relying on email alone. And for the payment itself, cross-border deals are exactly where a payment router earns its keep: it removes the multi-day window where a wire is technically "sent" but unconfirmed, during which an overseas account substitution has the most room to work undetected.

How should you handle a client who refuses basic verification?

A legitimate client with nothing to hide rarely objects to confirming who they are, particularly when you frame it as routine rather than suspicious: "this is standard for first-time clients over [amount]" lands very differently than "I don't trust you." If a prospective client pushes back hard on a request as light as a callback to their company's main line, or refuses to name a second contact at their own organization, treat that refusal itself as information. It doesn't prove fraud, but it removes one of your main tools for catching it, and that changes how much risk you should be willing to carry on the deal.

How does the payment itself protect you if verification isn't enough?

Verification reduces the odds something is wrong; it does not eliminate them, and the last line of defense is how the payment itself is structured. The two things that matter most are: nothing should transfer — goods, access, signed work — before the payment has irreversibly settled, and every party's share of a multi-party deal should be agreed and signed before the client pays, not negotiated after the fact when money is already moving.

This is where a payment router differs from simply trusting an incoming wire. On Shaka, each recipient signs off on their share of a deal before the client's payment can be submitted at all, and the payment settles onchain as one final transaction — there's no multi-day window where funds are "sent" but not yet certain, and no step where a party has to trust that another one will forward their portion afterward. It doesn't replace the identity checks above, but it closes the part of the risk that identity checks can't reach: what happens between the client paying and everyone actually having their money.

How much verification is proportionate to the size of the deal?

Proportionate verification scales with what you stand to lose, not with how the relationship feels. A useful rule of thumb: for a deal under a few thousand dollars, a basic identity check (does this company exist, does this person work there) is usually enough. Between roughly $10,000 and $100,000, add a trade reference or commercial credit check and confirm payment details through a second channel. Above $100,000, treat the deal the way a bank would treat a large wire: independent confirmation of identity, funds, and payment instructions, done before the deal is treated as final — not after the money has moved and something looks wrong.

Over-verifying a small, low-risk deal wastes time that could go toward delivering the work. Under-verifying a large one is the mistake that actually costs money. The checks above are not about distrust; they are the same due diligence a bank runs on every wire above a threshold, just done by you instead of a compliance department.

Keep a brief record of what you checked and when — the registration search, the callback, the trade reference calls — even if it's just a line in your own notes. If a dispute ever arises, that record is what shows you exercised reasonable care before the money moved, and it takes less time to write than this paragraph took to read.

None of this is about assuming the worst of a new client. It's closer to the habit of checking both ways before crossing a street you've crossed a hundred times safely: the check costs almost nothing, and the one time it matters, it's the only thing that does.