Twelve Red Flags in a Data-Buyer Approach, and How to Check Who You're Dealing With

Interest in business data as a commodity is new for most owners, which makes it unfamiliar territory. Unfamiliar territory is where fees for nothing, unsafe data requests and exaggerated promises tend to appear. None of the warning signs below proves bad faith on its own, but several together should make you stop.

We have not tracked scams in this market and we do not quote statistics about them. The signs below are general good practice for any unsolicited commercial approach, applied to this one.

1. They want money first. A fee, deposit, "listing charge" or "verification payment" before anything has happened is a serious warning. Genuine buyers pay for data, they do not charge you to be considered. (Our own service is free, and we never ask you for money.)
2. They ask for raw files up front. Customer lists, employee records, database exports or credentials before any agreement exists, before you know who the buyer is, and before anyone has defined the scope.
3. They promise a price or say every business sells. No one can honestly say what an unseen set of records is worth, or that all businesses will find a buyer.
4. They create urgency. "Act today", "limited slots", "offer expires tonight". Real commercial processes take time.
5. They want secrecy from your own team. A request to keep it from colleagues, your legal adviser or your DPO is a reason to talk to them immediately.
6. They will not name the actual buyer. If you cannot find out who ends up with the data, you cannot judge the risk.
7. They are vague about who they are. A UK limited company must show its registered name, number and registered office on its website. GOV.UK sets out the rules. A missing or inconsistent identity is a concern.
8. They are vague about how they are paid. Anyone introducing you to a buyer should tell you plainly whether they are paid by the buyer, by you, or both.
9. They push you to a private messaging app. Moving from email to an unmanaged chat early, particularly with a request for documents, makes records hard to review later.
10. There are no written terms. Genuine arrangements involve contracts you can read, take advice on and keep.
11. They ask for system access. Logins, API keys or admin rights are never needed to explore whether there is a fit.
12. The details do not add up. Mismatched names, a brand-new domain, copy-pasted text, or claims that do not appear anywhere else.

• A named organisation you can look up, with a company number that matches the public register.
• A clear explanation of who the buyer is, what they publish about their criteria, and how any referral fee works.
• No request for files or credentials at the enquiry stage.
• A willingness to wait while you take advice.
• Written terms before anything is shared.

1. Search the company number on the Companies House register and check the name, status and registered office match what they told you.
2. Check the website shows the company details GOV.UK requires. See the GOV.UK guidance.
3. If they handle personal data in the UK, ask for their ICO registration reference and check it on the ICO register. The ICO explains who must pay in its data protection fee guidance.
4. Ask directly: who is the buyer, who pays you, and how much?
5. Ask for the terms in writing and read them, or send them to your adviser.
6. Look for the buyer's own published criteria and compare them with what the intermediary says.
7. Search the names and domain together with words like "scam" or "complaint". Absence of results proves nothing, but a pattern of them is informative.
8. Check your contracts and your inventory before replying to anything that asks for records. See Can You Share It?.

1. Stop sharing anything further and keep copies of all messages, files sent and payment details.
2. Tell your director, general counsel or whoever handles data protection straight away.
3. If personal data was involved and there is a risk to people, the ICO's breach reporting guidance explains the duty to notify where feasible within 72 hours of becoming aware. Take advice on whether it applies.
4. If money was paid or you suspect fraud, report it through Report Fraud, the national service for England, Wales and Northern Ireland.
5. Tell your bank immediately if you made a payment.
6. Review contracts that may have been breached and tell affected clients if your contracts require it.

• We never charge businesses for an enquiry and never ask for files, customer data, credentials or payment details.
• We say who operates this site, with a registered company you can look up. See About.
• We explain how we are paid on our disclosure page: a participating buyer may pay us a referral fee if an introduction leads to a qualifying commercial relationship. We never share any of it with the businesses that enquire.
• We do not promise acceptance, a price or a timetable. Buyers decide for themselves.

If you think anything on this site or in our communications falls short of that, tell us through the contact page.