0

I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin).

I need to verify the following:

  • Business Name
  • Representative First & Last Name
  • Address
  • Phone Number

Other business sites such as Groupon (wikihow article) verify identity by contacting each user (I'm not familiar if they ask for a business regestrition copy or how do they verify once they contact you).

But this seems slow, expensive and annoying, yet probably an effective way to verifying.

I was thinking of the sms verification code, that way I can takle down Location & Phone number, but there is all sort of way around this...

Is there a more effective way of verifying business/business owners identity and location?

AviD
  • 72,708
  • 22
  • 137
  • 218
Rod Vaugh
  • 61
  • 1
  • 1
    Verifying high-assurance SSL certificates basically does the same thing: conduct actual checks with humans through telephone and other means to provide the assurance. Like anything in security, the degree to which you need to apply it depends on the situation/asset. – logicalscope Mar 14 '12 at 04:50
  • 1
    you could always try to implement [security by letterhead](http://thedailywtf.com/Articles/Security-by-Letterhead.aspx)... :D – AviD Mar 14 '12 at 18:42
  • Oh, and welcome to [security.se]! Btw, if you haven't already - don't forget to check out the [FAQ]. – AviD Mar 14 '12 at 18:44

2 Answers2

2

One possibility: you could look up the company in Dun & Bradstreet database of businesses, look up the contact information for their professional contact, and contact the person listed in D&B to request verification of the business's status.

Another possibility: if the business has a Google+ business profile or a Facebook business page, you could use various methods to have them prove ownership of that profile. In that case, you'd basically be outsourcing verification to Google or Facebook. I don't know how secure that is.

D.W.
  • 98,860
  • 33
  • 271
  • 588
0

I'm curious what you wound up doing. I was thinking of email domain verification as a first step, and then allowing businesses to update their own information. I'm not sure how easily this could be spoofed though. This might not be effective, since many small business owners don't have their own domain. Similarly, and though I like @logicalscope 's suggestion I think many small business owners would not understand or be able to obtain SSL certs either.

Mike
  • 428
  • 1
  • 5
  • 8