Methodology
Every point of a score traces back to a record we read, with the source and the date we read it. This page is the whole method: the evidence, the weights, the scale, and the limits.
How the score is built
Nothing here is a black box. A score is the weighted result of records you can go verify yourself — and each report names the record it read and the date it read it.
30% of score · Refreshed weekly
Entity status, formation date, lapses and reinstatements, officer continuity, and whether the trade name on the invoice matches a filing. Coverage varies by state and every report states which office it read.
Sources: State entity filings and registered agent records, where the state publishes them
25% of score · Refreshed daily
Registration age, privacy proxies, look-alike spellings of an established dealer, and whether the site copy first appeared last month or six years ago.
Sources: WHOIS/RDAP registry records, public traffic ranking, web archive snapshots
25% of score · Refreshed monthly
Whether the stated yard, warehouse, or lot exists at that address — or resolves to a mailbox store, a residence, or a coworking suite.
Sources: Carrier address type and deliverability, street imagery, county parcel data where a county publishes it
20% of score · Checked per report
Whether the routing number's institution region matches the state of incorporation, and whether the wire block was edited into the document.
Sources: ABA routing directory, document metadata
What a flag actually looks like
Corporate registry
The filing exists, which is why a quick search looks fine. The status line does not: administratively dissolved, with no reinstatement on record.
Document forensics
Surrounding text is vector. The bank details sit on their own raster layer with a different paper tone and a visible seam along the top edge.
Address & parcel records
The address on the quote maps to a single-family parcel on a residential cul-de-sac — no yard, no gate, no machines on the ground.
Documents shown are redacted or reconstructed from real casework patterns. Report pages cite the issuing office, file number, and retrieval date.
The scale
300–400
Adverse signals found
Several adverse signals in the records we read: a very new or lookalike web address, a mailbox-only address, or payment details that do not line up.
401–700
Thin record
New entity or thin public record. Nothing adverse stands out, but there is not enough here to corroborate them — hold funds until documents check out.
701–1000
No adverse signals found
Registry filing found, continuous digital footprint, payment details consistent with registered geography.
Why not just ask an AI chatbot?
Ask an assistant “is this company legit?” and you get a fluent, confident paragraph with no record behind it. That is the answer that costs $10,000.
The check
General AI tools
Claude · ChatGPT · Grok
Our scoring model
VendorScore.ai
Reads the entity filing where the state publishes it
General AINo — recalls whatever it absorbed months ago
VendorScoreRetrieved live, with file number, status line, and retrieval date
Checks domain and certificate age
General AINo WHOIS or DNS record access
VendorScoreRegistration date, registrar, and first-seen certificate
Checks what the address actually is
General AINot available to a chat model
VendorScoreCarrier address type, mailbox-store and residential flags, street imagery
Verifies the routing number's home state
General AIWill often invent an issuing bank
VendorScoreABA directory lookup against the entity's registered state
Inspects invoice PDF layers and metadata
General AIReads the text, not the document structure
VendorScoreProducer string, layer composition, raster patches on wire blocks
Cites the office, file number, and retrieval date
General AIFluent prose, no citation you can open
VendorScoreEvery signal links to the record behind it
Says so when a source is unavailable
General AIFills the gap with a confident guess
VendorScoreMarks the signal unavailable and withholds the points
Returns the same score twice for the same subject
General AIAnswer drifts between sessions and models
VendorScoreFixed signal weights, versioned model, reproducible score
What the model actually is
A scoring model over retrieved records, not a chat answer. Signals are extracted from the source documents, weighted at fixed values, and summed into the 300–1000 score. The weights and the scale are published as model v1.3, so the same subject scores the same twice and any point of the score can be traced back to a record.
Where language models are used
For reading, never for deciding: matching entity names across filings, parsing invoice layouts, and summarizing what a document says. They never assign points, and anything they infer is labeled an inference in the report.
The numbers
$0.00B
Reported BEC losses, 2025
0
BEC complaints filed, 2025
$0K
Median reported BEC loss per incident
Billions of USD, per year
Source: FBI Internet Crime Complaint Center (IC3) annual reports, business email compromise category. 2025: $3,046,598,558 across 24,768 complaints.
Share of scanned counterparties, by 100-point bin
Illustrative distribution shown while the scored population is still small. Replaced with live figures once the sample is large enough to publish.
A new loss category
AI-assisted share of reported losses, 2025
$893M of $20.9B · 4.3% and rising
Source: FBI Internet Crime Complaint Center annual report, 2025. Figures are federally reported losses, not VendorScore data.
Why the old checks stopped working
“The website looked professional.”
A convincing storefront, product copy, and staff photos are now a weekend of generated output on a domain registered last month.
“I spoke to their rep on the phone.”
Cloned voice and generated video make a callback to a number printed on the invoice worthless as verification.
“The invoice matched their branding.”
Logos, PO formats, and letterhead are trivially reproduced. What does not reproduce is a filing history or a parcel record.
Generated material is cheap. Records are not: a state filing, a parcel classification, and a routing number’s home region either exist and agree, or they do not.
Straight answers
Why the scores get sharper
Every check contributes to a real-time B2B trust graph: which entities transact with which, what legitimate invoices look like, and how fraudulent ones deviate. Enterprise vendor-risk platforms sell this to the Fortune 500 for six figures a year and leave everyone else with forum threads. VendorScore starts at the other end — the contractor about to wire $25,000 for an excavator — and works up.
Try it on a vendor
Who’s behind this
A real person, a registered entity, and a real address stand behind these scores. Read about us.