VendorScore.ai

Vendor risk scoring

Check a vendor’s risk score
before you wire funds.

Enter the vendor’s email, website, or company name — whatever you have. Nobody has forty minutes to pull a state filing, check a domain’s age, and confirm a routing number. We do it in about twelve seconds and show you the evidence behind the score.

Paste the email address on their invoice or quote — or their website if that’s all you have.

No time, money already moving?

Drop the invoice or wire instructions (PDF) and we read the routing number and the document’s edit history.

3 free checks a month · no account needed ·

300–1000
Score range
9
Evidence categories
~12s
Instead of 40 minutes

How a check works

  1. 01Identify the entityResolve the business behind the email, invoice, website, or name you gave us.
  2. 02Read the public recordRegistry record, DNS and mail configuration, traffic ranking, archive history.
  3. 03Cross-check payment detailsRouting number origin against the entity’s registered geography.
  4. 04Score and show the evidenceEvery point of the 300–1000 score traces to a signal you can read.

Records read live on every check: domain registry (RDAP) · DNS mail, SPF and DMARC records · public traffic ranking · web archive history · the website itself. Anything we cannot read is marked not read — never as a pass.

Worked examples

What a check actually catches.

Two shapes of the same transaction: an equipment purchase from an established dealer, and the same machine offered by a vendor who copied their listing.

934of 1000

Clean vendor

Sonoran Equipment & Rental Co.

Phoenix, AZ · $41,000 — used 2019 excavator

Clear

No adverse signals found

  • PASSCorporate entityActive AZ registration, 14 years on file, no lapses
  • PASSPhysical addressCommercial-classified delivery point, fenced 3.4-acre equipment yard
  • PASSPayment detailsRouting 122105278 resolves to an Arizona institution, matching the LLC

Evidence artifact

Street imagery at the registered address. Fenced commercial lot with machines on the ground, matching the commercial delivery-point classification and the yard described on the filing.
Street imagery at the registered address. Fenced commercial lot with machines on the ground, matching the commercial delivery-point classification and the yard described on the filing.

Invoice released same day

The buyer stopped waiting on a reference call and wired on the spot. Verification cost: one free check.

Check your own vendor
318of 1000

Impostor vendor

Vista Ridge Machinery LLC

Mesa, AZ · $5,300 — deposit on the same excavator

Critical Risk

Adverse signals found — do not wire

  • FAILInvoice documentPDF producer: Adobe Photoshop; bank block sits on its own image layer
  • FAILDomain and listingsDomain registered 24 days ago; machine photos match an unrelated dealer's listing
  • FAILPayment detailsBeneficiary bank is an offshore institution in Bermuda; the LLC is registered in AZ

Evidence artifact

Page 1 of the deposit invoice submitted by the vendor. The wire block is a separate image layer with its own paper tone and a visible seam — the surrounding text is vector, the bank details are not.
Page 1 of the deposit invoice submitted by the vendor. The wire block is a separate image layer with its own paper tone and a visible seam — the surrounding text is vector, the bank details are not.

Wire stopped — $5,300 not sent

Once funds leave on a fraudulent wire, recovery is rare. A $19 report is the cheapest part of the transaction.

Illustrative examples composed from typical signal patterns — not live data on any named business.

What a flag actually looks like

Every flag in a report points at a record you can open yourself.

Scan of a Secretary of State certificate of formation stamped ADMINISTRATIVELY DISSOLVED in red ink.

Corporate registry

The entity on the invoice is dissolved

The filing exists, which is why a quick search looks fine. The status line does not: administratively dissolved, with no reinstatement on record.

Macro scan of an invoice showing the wire transfer instruction block pasted on as a separate patch with a visible rectangular seam.

Document forensics

The wire block was pasted in

Surrounding text is vector. The bank details sit on their own raster layer with a different paper tone and a visible seam along the top edge.

Aerial parcel photo of a suburban cul-de-sac with one parcel outlined in red, showing a single-family house rather than a commercial lot.

Address & parcel records

The 3-acre yard is a house

The address on the quote maps to a single-family parcel on a residential cul-de-sac — no yard, no gate, no machines on the ground.

Documents shown are redacted or reconstructed from real casework patterns. Report pages cite the issuing office, file number, and retrieval date.

The numbers

Wire fraud against businesses is not a rare event. It is an annual, growing line item.

$0.00B

Reported BEC losses, 2025

0

BEC complaints filed, 2025

$0K

Median reported BEC loss per incident

Reported BEC losses, United States

Billions of USD, per year

20212022202320242025

Source: FBI Internet Crime Complaint Center (IC3) annual reports, business email compromise category. 2025: $3,046,598,558 across 24,768 complaints.

Score distribution

Share of scanned counterparties, by 100-point bin

300400500600700800900
  • 300–400 critical
  • 401–700 caution
  • 701–1000 clear

Illustrative distribution shown while the scored population is still small. Replaced with live figures once the sample is large enough to publish.

A new loss category

AI-assisted fraud is now its own line in the federal numbers.

$0M
Losses logged as AI-assisted fraud, 2025 — a category the IC3 did not report separately a few years ago.
0+
Complaints in that category over the same year.
$0.0B
All reported US payment fraud, 2025 — up 26% on the prior year.

AI-assisted share of reported losses, 2025

$893M of $20.9B · 4.3% and rising

Source: FBI Internet Crime Complaint Center annual report, 2025. Figures are federally reported losses, not VendorScore data.

Why the old checks stopped working

  • “The website looked professional.”

    A convincing storefront, product copy, and staff photos are now a weekend of generated output on a domain registered last month.

  • “I spoke to their rep on the phone.”

    Cloned voice and generated video make a callback to a number printed on the invoice worthless as verification.

  • “The invoice matched their branding.”

    Logos, PO formats, and letterhead are trivially reproduced. What does not reproduce is a filing history or a parcel record.

Generated material is cheap. Records are not: a state filing, a parcel classification, and a routing number’s home region either exist and agree, or they do not.

Where the wires go

Industries that pay strangers by wire.

The pattern is the same everywhere: a large payment, a vendor you have never stood in front of, and no time to verify. Only the paperwork changes by industry.

$3.05B

Reported BEC losses, 2025

24,768

Complaints filed, 2025

Business email compromise was the second-largest fraud category by loss last year, behind investment fraud. It moves almost entirely by wire, and freezing funds depends on reporting within hours. Source: FBI IC3 2025 Internet Crime Report.

Construction & trades

Material deposits and subcontractor draws paid ahead of delivery

Typical wire

$5K – $150K

$3K$2M

Common pattern

A subcontractor you already work with emails updated remit-to details mid-project, from a look-alike domain.

Caught by

Payment instruction consistency

Heavy equipment & machinery

Used machine purchases from dealers and private sellers

Typical wire

$15K – $250K

$3K$2M

Common pattern

Listing photos and inventory copy lifted from a real dealer, sold by an entity registered weeks ago with a deposit-first term.

Caught by

Domain and digital footprint

Containers, freight & logistics

Container purchases, carrier settlements, broker prepay

Typical wire

$3K – $60K

$3K$2M

Common pattern

Double-brokered loads and container yards that resolve to a residential parcel or a mailbox suite.

Caught by

Physical address and parcel records

Manufacturing & supply

Purchase orders and tooling deposits to new suppliers

Typical wire

$10K – $500K

$3K$2M

Common pattern

A compromised supplier mailbox sends a real invoice with one changed field: the beneficiary bank.

Caught by

Payment instruction consistency

Agriculture

Inputs, seed and feed contracts, implement purchases

Typical wire

$8K – $200K

$3K$2M

Common pattern

Seasonal urgency plus a broker with no filing history — payment demanded before any inspection.

Caught by

Corporate registry

Commercial real estate

Earnest money, closing funds, and contractor payouts

Typical wire

$25K – $2M

$3K$2M

Common pattern

Diverted closing wires sent after a spoofed reply in a live escrow email thread.

Caught by

Payment instruction consistency

Loss and complaint figures are national totals for business email compromise as reported by the FBI Internet Crime Complaint Center for 2025. Typical wire ranges are illustrative transaction sizes for each industry — they are not loss estimates and not a measurement of any market.

Why not just ask an AI chatbot?

A general model answers from memory. A vendor check has to read today’s record.

Ask an assistant “is this company legit?” and you get a fluent, confident paragraph with no record behind it. That is the answer that costs $10,000.

  • Reads the entity filing where the state publishes it

    General AINo — recalls whatever it absorbed months ago

    VendorScoreRetrieved live, with file number, status line, and retrieval date

  • Checks domain and certificate age

    General AINo WHOIS or DNS record access

    VendorScoreRegistration date, registrar, and first-seen certificate

  • Checks what the address actually is

    General AINot available to a chat model

    VendorScoreCarrier address type, mailbox-store and residential flags, street imagery

  • Verifies the routing number's home state

    General AIWill often invent an issuing bank

    VendorScoreABA directory lookup against the entity's registered state

  • Inspects invoice PDF layers and metadata

    General AIReads the text, not the document structure

    VendorScoreProducer string, layer composition, raster patches on wire blocks

  • Cites the office, file number, and retrieval date

    General AIFluent prose, no citation you can open

    VendorScoreEvery signal links to the record behind it

  • Says so when a source is unavailable

    General AIFills the gap with a confident guess

    VendorScoreMarks the signal unavailable and withholds the points

  • Returns the same score twice for the same subject

    General AIAnswer drifts between sessions and models

    VendorScoreFixed signal weights, versioned model, reproducible score

What the model actually is

A scoring model over retrieved records, not a chat answer. Signals are extracted from the source documents, weighted at fixed values, and summed into the 300–1000 score. The weights and the scale are published as model v1.3, so the same subject scores the same twice and any point of the score can be traced back to a record.

Where language models are used

For reading, never for deciding: matching entity names across filings, parsing invoice layouts, and summarizing what a document says. They never assign points, and anything they infer is labeled an inference in the report.

The scale

One number, three decisions.

300–400

Critical Risk

Adverse signals found

Signals consistent with known fraud patterns: spoofed domain, mailbox address, mismatched payment instructions.

401–700

Caution

Thin record

New entity or thin public record. Not necessarily fraudulent, but not yet corroborated — hold funds until documents check out.

701–1000

Clear

No adverse signals found

Registry filing found, continuous digital footprint, payment details consistent with registered geography.

How the score is built

Four evidence categories. Every flag shows its source.

Nothing here is a black box. A score is the weighted result of records you can go verify yourself — and each report names the record it read and the date it read it.

Score weighting
  • Corporate registry30%
  • Domain & digital footprint25%
  • Address & parcel records25%
  • Payment instructions20%

Corporate registry

30% of score · Refreshed weekly

Entity status, formation date, lapses and reinstatements, officer continuity, and whether the trade name on the invoice matches a filing. Coverage varies by state and every report states which office it read.

Sources: State entity filings and registered agent records, where the state publishes them

Domain and digital footprint

25% of score · Refreshed daily

Registration age, privacy proxies, look-alike spellings of an established dealer, and whether the site copy first appeared last month or six years ago.

Sources: WHOIS/RDAP registry records, public traffic ranking, web archive snapshots

Physical address

25% of score · Refreshed monthly

Whether the stated yard, warehouse, or lot exists at that address — or resolves to a mailbox store, a residence, or a coworking suite.

Sources: Carrier address type and deliverability, street imagery, county parcel data where a county publishes it

Payment instruction consistency

20% of score · Checked per report

Whether the routing number's institution region matches the state of incorporation, and whether the wire block was edited into the document.

Sources: ABA routing directory, document metadata

Straight answers

What people ask before they trust a number.

How accurate is this?
Accuracy depends on the record, so we show the record. A lapsed corporate filing or a routing number in the wrong state is a fact with a citation and a date. Behavioral inferences are labeled as inferences. If a source is stale or unavailable for a subject, the report says so rather than guessing.
Does a Clear score mean the vendor is safe?
No. Clear means we found no adverse signals in the records we read on the date we read them — it is not a clearance and not a prediction of conduct. A score is a risk indicator for a decision you make, the same way a credit score informs a lender who still writes the loan.
I run a legitimate business and my score is low. Now what?
Low scores usually mean thin public record, not wrongdoing: a new entity, a private WHOIS record, or a yard leased under another name. Claim the profile, submit documentation, and the score is re-run within two business days. Corrections are free and the change history stays visible.
I don’t have time for another tool.
That is the point. One paste, about twelve seconds, and you either move on or you pick up the phone. There is nothing to set up and no account to create.

Pricing

The score is free. The reasons behind it are paid.

Anyone can check any vendor and see the number. To read what we found and why it matters, open the full report.

No account

$0

Unlimited scores

  • The score and the risk band, every time
  • The list of what we checked
  • The reasons behind the score stay hidden
Run a check above

Free account

$0

1 full report a month

  • Everything above
  • One full report a month, all findings shown
  • No card required
Create a free account

Pro

$99

per month

  • Unlimited full reports
  • Every finding on every vendor you check
  • Cancel any time
Go unlimited

Why the scores get sharper

Every check contributes to a real-time B2B trust graph: which entities transact with which, what legitimate invoices look like, and how fraudulent ones deviate. Enterprise vendor-risk platforms sell this to the Fortune 500 for six figures a year and leave everyone else with forum threads. VendorScore starts at the other end — the contractor about to wire $25,000 for an excavator — and works up.