Shell company detection

Forming a company in most U.S. states takes a form, a fee, and an afternoon. The registry's job is to record that filing, not to audit it. So a clean, active, in-good-standing registration proves exactly one thing: someone filed and paid.

A fraud team that verifies registration status is verifying the single fact the fraudster controls completely. Worse, a clean registration reads as reassurance — the file looks tidy precisely because nothing else was checked.

Shells are not exotic. They are cheap, legal to create, and useful for a long list of ordinary purposes, which is why detecting them is a question of evidence rather than of catching someone in a lie.

That is the sorting question. A website fools nobody but you. Two years of card transactions would require thousands of cardholders and their banks to be in on it.

Sort the rows by the middle value — who controls the signal. Everything the applicant controls sits on one side of that line, and no quantity of it adds up to evidence: ten self-reported attributes are still one party's word.

The signals worth paying for are the ones with an independent producer and a timeline. Time depth is the part that is hardest to manufacture: a business can buy a domain this morning, but it cannot buy eighteen months of transactions dated last year.

This is why shell detection is unlike most fraud detection. There is no contradiction to catch, no mismatched date of birth, no address that disagrees with the document. The file comes back thin, not wrong.

Any system that returns a boolean converts “we found nothing” into “pass.” The absence — the part that should have raised the alarm — is the exact part that gets discarded on the way to the answer.

So the mechanism is to report the thinness instead of smoothing it: how many independent sources corroborated the entity, how far back the evidence runs, and whether anyone has ever observed money moving through it.

Registered-agent addresses, mail drops, and virtual offices are legitimate and extremely common. They are also the cheapest way to give a shell a street address, which is why they need to be visible rather than silently accepted.

The patterns worth surfacing: many unrelated entities sharing one suite; an address that belongs to a mail-receiving service; and an address that appears only in filings and never in an inspection, a permit, a delivery, or a review.

The right treatment is to change what else you need to see, not to decline. A single-member consultancy registered at its agent's address is an ordinary business. The same address paired with no operating evidence at all is a different case. Enigma Verify carries virtual-address flags for this reason.

A thin file returns Tier 1 by construction: self-reported evidence only. That is a description, not an accusation, and it is actionable in a way a decline is not — approve at a low limit, ask for one independent signal, or re-check in ninety days once there is something to observe.

The other half is the people. Officers, registered agents, and beneficial owners get screened against sanctions, PEP and watchlist sources and adverse media, at over a billion requests a month. A shell with no operating history is often attached to someone who does have one.

Neither half is a shell detector on its own. Together they answer the question that matters: is there anything here besides paperwork, and who is standing behind it?