Vendor and supplier verification: a practical process

Hire Your Detective editorial teamUpdated 21 October 20268 min read

What is vendor verification and why does it matter?

Vendor verification (also called vendor screening or supplier due diligence) is the process of confirming that a supplier is who it says it is, is legally able to do business, is owned by the people you think, and can deliver what it promises, before it is added to your vendor master and paid.

The risks it addresses are very Indian and very common: paper companies set up to raise fake invoices, a purchase executive's relative quietly running a "preferred supplier", bank details changed by a fraudulent email, GST input credit lost because the supplier never filed returns, and advance payments to traders who disappear. Verification is an ongoing control, not a one-time check. If you only need to confirm a single company once, our guide on how to verify a company in India covers the basic portal searches. For a merger or investment, you need full due diligence.

How deep should you check each vendor?

Not every stationery supplier needs a field visit. Tier vendors by risk and apply checks accordingly:

How to do vendor verification: step by step

1. Collect a vendor registration form with legal name, constitution, PAN, GSTIN, Udyam number (if MSME), registered and operating addresses, names of owners or directors, bank details on a cancelled cheque, and a declaration of any relationship with your employees.
2. Verify GST. Search the GSTIN on the GST portal (services.gst.gov.in): legal name, trade name, status (active, suspended, cancelled), principal place of business, and return filing history. A vendor who does not file returns can cost you input tax credit.
3. Verify the entity. For companies and LLPs, check master data, directors, status and registered charges on the MCA portal. For proprietorships, rely on GST, Udyam, Shops and Establishment registration and the PAN.
4. Confirm the bank account. Use a penny-drop or account validation through your bank to confirm the name on the account matches the vendor's legal name. For high-value vendors, ask the vendor's bank for a signed confirmation.
5. Search litigation. Run the company and its promoters through eCourts and the NCLT cause lists, and check for insolvency proceedings. Our guide on checking court cases against a person explains the searches.
6. Check for conflicts. Compare vendor addresses, phone numbers, directors and bank accounts against your employee master.
7. Visit the site. Confirm the address exists, the business operates there, the machinery or stock matches the claimed capacity, and staff are present.
8. Take references from customers you find yourself, not only those the vendor gives you.
9. Document and approve. Record findings in a vendor verification report and require sign-off outside the purchasing team.

How do you verify a vendor's bank account?

This is where most supplier frauds succeed. Fraudsters either open an account in a name similar to the real vendor, or send a convincing email claiming the vendor has "changed banks". Controls that work:

• Name match on a penny-drop validation, compared with the GST legal name, not the trade name alone.
• A cancelled cheque or bank letter on the vendor's letterhead, signed by an authorised signatory.
• Any change of bank details confirmed by a call-back to a phone number already on file, never to the number in the change request email.
• A cooling period or second approval before the first payment to new details.

If money has already gone to a fraudulent account, report it immediately at cybercrime.gov.in or on 1930; speed matters for freezing funds. See how to report cyber fraud in India.

What are the red flags in supplier verification?

• Bank account in a name different from the vendor's legal name, or in an individual's name for a company.
• GST registration very recent, cancelled, suspended, or with long gaps in filing.
• Registered address is a residential flat, a virtual office or a shared address used by many unrelated companies.
• Directors who are also directors of dozens of other small companies, or who seem to have no connection to the trade.
• Pressure for large advances, or unwillingness to allow a site visit.
• Prices far below the market without a believable reason.
• A vendor introduced and championed by one employee who resists any independent check.
• Shared phone number, email domain or address with an employee or another vendor.

Vendor collusion with staff is one of the most common forms of internal fraud. If you find signs of it, treat it as an employee fraud investigation, not just a vendor problem.

What is a vendor verification report?

A vendor verification report is the written record of the checks done and what was found. A useful report contains:

• Vendor identity details and the documents relied on.
• Results of each registry search (GST, MCA, Udyam), with dates.
• Bank account validation result.
• Litigation, insolvency and adverse media findings.
• Ownership and related-party findings, including any link to your staff.
• Site visit notes and photographs of the premises (public or business areas, with permission).
• A risk rating and recommendation: approve, approve with conditions (no advance, smaller first order), or reject.

Keep the report on file. It helps auditors and also protects the people who approved the vendor if something later goes wrong.

How do you screen overseas or brand-new suppliers?

Two categories need extra care. Overseas suppliers cannot be checked on Indian portals, so rely on the company registry of their own country, a letter from their bank confirming the account, independent trade references, and, for large orders, a pre-shipment inspection by an inspection agency. Insist on payment terms that protect you, such as a letter of credit, rather than full advance by wire.

Newly incorporated vendors are not automatically suspicious; every business starts somewhere. But a company registered a few weeks ago, with no filing history, offering to handle a large order on advance payment deserves a site visit, a look at the promoters' track record in earlier businesses, and a smaller trial order before full onboarding.

In both cases, write down why the vendor was approved despite the gaps. That record is what auditors and investigators look for if something goes wrong.

When should you use an outside investigator for vendor screening?

Your procurement team can handle portal checks. External help is worth it for high-value or high-risk suppliers, overseas or out-of-state vendors you cannot easily visit, suspected shell companies, and when you suspect a link between a vendor and an employee. An investigator can do discreet site verification, ownership and group mapping, local market reputation enquiries and background checks on promoters, all through lawful sources and field work.

You can find a verified investigator near the vendor's location on Hire Your Detective; our corporate investigation page explains the scope. Costs vary by city, number of locations and depth, so ask for a written scope before work begins.

Bottom line

Good vendor verification is a habit, not a form. Confirm existence, ownership and the bank account every time; add litigation searches, conflict checks and site visits as risk rises; and re-verify whenever details change. Most supplier frauds that succeed in India pass because one of these simple checks was skipped.

This guide is general information, not legal advice. Laws and procedures change, and every case is different — speak to a lawyer about your situation. In an emergency, call 112.