A few years ago, a colleague of mine spent three weeks trying to track down the owner of a plumbing company that had taken a deposit from his elderly mother and vanished. The company had a listing in two local directories, a website with a stock-photo crew smiling on a rooftop, and a registered address that turned out to be a UPS Store mailbox in suburban Ohio. The state business registry showed it as “active.” Everything looked legitimate. Nothing was.

That experience stuck with me, partly because it’s not unusual. Business fraud built on shell company structures and fabricated listings is, in a mundane and unglamorous way, one of the most persistent forms of financial crime ordinary people encounter. It doesn’t make headlines the way securities fraud does, but it bleeds money from consumers and poisons the well for legitimate small businesses trying to build a credible online presence. And it starts, almost always, with a surprisingly easy first step: registering a company that doesn’t really exist in any meaningful sense.

The mechanics are worth understanding if you’re trying to build or protect a legitimate business listing — and especially if you’re the kind of person who uses local business directories to find services, hire contractors, or vet vendors. Knowing how the fraud is constructed tells you exactly what to look for when something feels off.

How a Fake Business Gets Built, Step by Step

The foundation is almost always a state business registration. In the United States, forming an LLC or corporation is deliberately easy — by design, because the country wants to encourage entrepreneurship. In most states you can file articles of incorporation online in under twenty minutes for less than a hundred dollars. Many states ask almost nothing: a name, a registered agent address, and a filing fee. Delaware, Wyoming, and Nevada are particular favorites for fraudulent actors because their disclosure requirements are minimal and their registered agent industries are large and anonymous. You can form a Wyoming LLC without ever listing a single human name in any public document.

Once the entity exists on paper, the next layer is the address. Virtual office services and mailbox rental companies provide a street address that looks, from the outside, like a real office. Some of these services are entirely legitimate — remote workers and small startups use them constantly — but they’re also the preferred infrastructure for shell company operators. A suite number at a virtual office building in Denver or Dallas gives a listing an air of physical permanence it doesn’t actually have.

Then comes the directory presence. This is where the problem intersects directly with the world of local business listings. A bad actor submits the new entity to free business listing platforms — sometimes dozens of them simultaneously, using automated tools — and suddenly the company appears to have a footprint. It shows up in search results. It has “reviews” (often fabricated or purchased). It has a phone number routed through a VoIP service that can be disconnected and re-routed in seconds. The whole structure is designed to look like a business without any of the accountability that comes with being one.

The most sophisticated versions of this fraud layer in what investigators call “aged” shell companies — entities that were registered years ago, kept dormant, and then activated for a scheme. An aged shell with a three-year-old registration date looks far more credible than one filed last Tuesday. You can buy them. There are brokers who do nothing else. The Financial Action Task Force, the intergovernmental body that sets global standards on money laundering and financial crime, has documented this practice extensively, noting that aged shells are particularly useful because their registration history passes casual scrutiny.

What’s striking, when you look at this from the inside out, is how little active deception is required at any individual step. Each piece — the state registration, the virtual address, the directory listing, the phone number — is a legitimate service being used for an illegitimate purpose. The fraud is assembled from entirely real components. That’s what makes it hard to detect and easy to rebuild after it collapses.

For the people running local business directories, this creates a genuine dilemma. The whole value proposition of a directory is that it lowers the friction of discovery — businesses get found, customers find services. Heavy verification requirements at the point of submission would slow that down and push legitimate small businesses, who may not have a lot of documentation readily at hand, toward competitors with looser standards. But no verification at all is an open invitation to exactly the kind of paper ghost my colleague’s mother encountered.

What Registry Verification Actually Looks Like Now

The verification landscape has changed meaningfully in the last decade, driven partly by regulatory pressure and partly by the reputational damage that comes from being the platform where fraud flourishes. The improvements aren’t perfect, but they’re real, and understanding them helps you assess how much to trust any given listing source.

At the state level, the most significant recent development in the United States is the Corporate Transparency Act, which took effect in January 2024. It requires most small businesses to file beneficial ownership information with the Financial Crimes Enforcement Network — meaning an actual human being’s name, address, and ID number has to be on file with the federal government, not just a registered agent. This doesn’t make all shell company fraud impossible, but it dramatically raises the cost and risk of the most anonymous structures. Non-compliance carries civil and criminal penalties.

At the directory level, the verification approaches vary enormously. The better platforms have moved toward a multi-signal model rather than a single point of verification. Moz’s directory ecosystem, for instance, has long weighted listings based on consistency signals — whether the name, address, and phone number of a business appear consistently across multiple authoritative sources. A listing that exists in only one place, with no corroborating signals anywhere else on the web, scores poorly regardless of how polished it looks. That’s a meaningful structural defense against freshly created shells, which by definition have no history.

Google’s Business Profile verification process, for all its frustrations, works on a similar logic. Phone verification, postcard verification to a physical address, video verification for higher-risk categories — these layers aren’t foolproof, but they require a fraudulent actor to invest time and resources at each step, which raises the cost of the scheme and reduces its profitability. Citysearch’s free business listing process and similar platforms have incorporated phone verification as a baseline, though the depth of that verification varies. The honest answer is that no free listing service can afford the labor-intensive verification that a bank or licensed contractor board does. The economics don’t support it.

What the better registries and directories are increasingly doing is treating verification as an ongoing process rather than a one-time gate. Listing monitoring — watching for sudden changes in address, phone number, or category that don’t match the pattern of a legitimate business — catches a lot of fraud that passes initial submission. A legitimate plumbing company doesn’t change its address three times in six months. A legitimate accountant doesn’t suddenly list itself as a roofing contractor. Pattern anomalies are often more revealing than any single data point.

The Federal Trade Commission’s guidance for small businesses includes advice on how to protect your own legitimate listings from being hijacked — a related but distinct problem where bad actors claim and modify legitimate business profiles to redirect customers. It’s worth reading if you manage any kind of online business presence, because listing hijacking is, in some ways, the inverse of shell company fraud: instead of building a fake entity, the fraudster takes over a real one.

For the average person using a local business directory to find a contractor, a restaurant, or a service provider, the practical takeaway from all of this is that verification signals are cumulative. No single signal is definitive. A business with a long history of consistent listings across multiple platforms, with reviews that span years and mention specific employees or details, with a physical address that appears on mapping services as an actual building — that business is much harder to fake than one that exists only in a single directory with five identical-sounding five-star reviews posted in the same week.

The paper ghost problem isn’t solved. It probably never will be entirely, because the same openness that makes it easy to commit business fraud is the openness that makes it possible for a first-generation immigrant with fifty dollars and a good idea to start a company this afternoon. That tradeoff is worth making. But it means the work of registry verification — boring, technical, unglamorous work — is genuinely important infrastructure. It’s what separates a directory that helps people find real businesses from one that just helps fraudsters find victims.

My colleague’s mother eventually got her money back, after a small claims filing and a lot of persistence. The “plumbing company” is gone, of course — dissolved, probably re-formed under a different name somewhere else. That’s the other hard truth about shell company fraud: even when you catch it, the cost of catching it usually falls on the person who got hurt.