A real South African company name, a fake buyer: how to tell

This is company impersonation: the buyer uses a real, registered South African company's name and registration number, and their own domain, phone number and bank account. A registration check alone won't catch it, because the registration is real — the company exists, it's registered, it's been trading for years. The person who emailed you is simply not part of it. Below: what a registration search actually confirms, what the domain record adds, and what to check before you ship.

Does a company registration search confirm who's emailing you?

The Companies and Intellectual Property Commission (CIPC) keeps South Africa's company register, and there are two ways into it — neither of them anonymous. The register is searchable by enterprise name, enterprise number or a director's ID or passport number (CIPC eServices), but CIPC's own search page says that search "has been moved to the BizPortal website" and that "you now have to login before conducting any search", in compliance with the Protection of Personal Information regulations (CIPC eServices, entity search). The fuller record — enterprise type and status, registration date, physical and postal address, registered directors and members — comes from CIPC's Enterprise Enquiry, which needs a registered CIPC customer code and the enterprise number rather than the name (CIPC step-by-step guide).

Neither record holds a domain, a phone number or a bank account. A registration number that matches a real, existing company tells you the company is real. It tells you nothing about whether the person who emailed you is connected to it.

Who really owns the domain the message came from?

South Africa's .za domain space is regulated by the .ZA Domain Name Authority (ZADNA), and the public WHOIS lookup for .co.za — the record of who registered a domain — is run by the ZA Registry Consortium, ZARC (ZARC).

Two fields in that record answer the question on this page. "Registrant Organization" names the company the domain is registered to: a buyer who writes from a domain registered to a different company, to an individual, or to no named organisation at all, is the mismatch to ask about before you reply. "Creation Date" tells you how long the domain has existed: a domain registered weeks ago, used by a company that claims years of trading, is a second mismatch.

The lookup does not publish the registrant's email or phone — for those it refers you to the registrar listed on the record (ZARC). A domain registered to the company whose name is on the purchase order, and old enough to fit the trading history the buyer describes, is a better sign than the name alone.

What else should match before you rely on a message?

Three things are worth confirming before you treat the sender as the company:

• Call the number on the company's own website — found through a search, not copied from the email signature — and ask for the person who contacted you by name.
• Compare the payment details to the registered company, not to a similar-sounding name or an individual director's personal account. The legal entity receiving payment should match the legal entity on the registration you looked up.
• Treat a first order from a "known" company the same as a first order from a stranger until one of these checks confirms the channel, not just the name.

B2B.Africa never asks you to pay a buyer, a tender committee or an agent.

See checking a South African company for the full registry walkthrough, and verifying a company anywhere in Africa if the buyer isn't in South Africa. For the full map of related patterns, see Trade scams aimed at exporters to Africa.

This is general information, not legal advice.