How do I avoid fraud when acquiring an online business?

What does fraud look like at $50,000 to $150,000?

Fraud in this band is ordinary rather than clever, and it takes a small number of recognisable shapes. Nobody builds an elaborate long con for a $90,000 asset. They are hoping you accept an image, skip one check and send money directly to a bank account. Each shape is defeated by a specific and fairly boring piece of evidence.

How do you establish that the revenue is real?

Stop accepting documents that the seller produced and start looking at systems the seller cannot edit. Read-only access to the live billing account beats any export, and a processor-generated export beats any spreadsheet. Bank statements covering the same twelve months should agree with the processor after refunds, chargebacks and fees. Where the three sources disagree by more than a rounding error, the gap is the whole conversation.

A business at $3,000 MRR should show roughly $36,000 of gross annual charges, a visible refund rate, and net deposits arriving on a predictable rhythm. If the deposits are lumpy in a way the subscriptions do not explain, ask why before you ask anything else.

How do you confirm the seller owns what they are selling?

Ownership is checked asset by asset, from inside the account that holds it. Ask the seller to share their screen and walk the list live: the registrar showing the domain and its registrant details, the repository showing the organisation and its members, the hosting account, the DNS zone, the processor, the analytics property, the mailing list. You are watching for accounts registered to a personal address that was never mentioned, assets sitting under a collaborator's login, and anything the seller cannot reach without a phone call to somebody else.

Intellectual property that was made by other people is the quiet one. A logo drawn by a contractor, a template bought under a licence that does not permit resale, or code lifted from a former employer all travel badly. Ask for the assignment or the licence for anything the seller did not make themselves.

How do you know you are dealing with the actual owner?

Match the identity across records that were created at different times by different parties. The domain registrant, the company record, the processor account holder and the bank details on the escrow instruction should all point at the same person or entity. Impersonation at this size usually shows up as a small inconsistency the seller explains away: a payment name that differs "because of my accountant", a registrant behind privacy that cannot be lifted, an email domain registered three weeks ago.

A short video call, with the seller logged into the live product and the billing account in front of you, resolves most of this in ten minutes. Anyone acquiring at six figures is entitled to ask for it, and a real founder finds the request unremarkable.

What stops a seller taking the money and going quiet?

Funds held by an independent, regulated escrow agent, released once, in full, after the buyer confirms the assets arrived. The buyer never sends money to the seller directly, and the platform never holds it either: Indiemaker is non-custodial, and the escrow agent is a separate regulated provider. Until the assets land and the buyer confirms against the schedule, the money is with the agent rather than with either party. That single arrangement removes most of the incentive to behave badly, because there is nothing to take.

Treat pressure to bypass it as the signal it is. A direct bank transfer, a request to split payment into parts, a deadline invented on the seller's side: each of these is a reason to slow the deal down rather than speed it up.

What does a curated route change?

Listings that are moderated and pre-screened before they appear remove a layer of noise, which means your diligence starts from a shorter and more plausible list. Indiemaker carried 155 businesses listed at $50,000 or above as at 14 September 2026, 112 of them between $50,000 and $150,000. Screening at the front door is not a substitute for your own checks, and no platform can do those for you.

What it does change is where your attention goes. Time not spent filtering obviously implausible listings is time spent on the processor export, the ownership walk-through and the asset schedule, which is where an acquisition is actually won or lost.

Which signals are worth walking away from?

Refusal to give read-only access to the live billing account, after an offer is on the table and confidentiality is agreed. That one is close to decisive. The rest, in rough order of how much they should worry you:

1. Numbers that only ever exist as images, with every request for a live view deflected.
2. An owner who cannot log into an account they claim to own while you watch.
3. Any push to move payment off escrow, or to pay in parts rather than once.
4. Names that do not match across the registrar, the processor and the bank details.
5. Urgency with no cause: a rival buyer who cannot be named, a deadline that appeared today.
6. Assets that the seller "will sort out after completion", particularly rights to work made by others.

None of these on their own proves dishonesty. Two of them together is usually enough to stop, and the deals you decline for this reason cost you nothing but a few evenings.

Related: how-to-tell-if-revenue-screenshots-are-real, due-diligence-for-a-100k-deal, how-escrow-works-on-a-six-figure-transfer