A listing shows $8,000/month in net profit. The seller has P&L screenshots, a Stripe dashboard photo, and three years of history. But is it real? Here's the exact process to find out.
Revenue verification is the single most important step in any online business acquisition. Everything downstream — the multiple you pay, your projected ROI, your ability to service debt — is built on the assumption that the numbers are real. Get this wrong and you've bought a story, not a business.
This guide walks you through exactly how to verify seller revenue, platform by platform, so you can close with confidence instead of hope.
Most fraud in online business acquisitions isn't dramatic. There's no elaborate shell company or forged tax return. It's subtle manipulation — a seller nudging numbers 20–40% higher than reality, betting that a motivated buyer won't dig deep enough to catch it.
These are the four most common methods:
Before you request a single document, request a live screen share. This is the single most effective verification tool available to a buyer — and most first-timers never ask for it.
Ask the seller to join a Zoom or Google Meet and log into their payment processor live, with you watching. What you're looking for in a live session:
A legitimate seller will do this without hesitation. Resistance — "I'm not comfortable sharing that" or "let me prepare a report instead" — should immediately raise your suspicion.
Stripe is the most common payment processor for SaaS and digital products. The right verification approach is to request read-only API access or conduct a live screen share into the Stripe dashboard.
Key data to pull:
Red flag: Refund rates above 5% of gross revenue. In a healthy SaaS or digital product, this number should be under 2–3%. High refund rates signal product-market fit problems, high churn, or aggressive sales practices that won't survive a transition.
For FBA businesses, request read-only access to Amazon Seller Central. The navigation path that matters most:
Red flag: Any single ASIN generating 80% or more of total revenue. That's not a business — it's a single product with a business valuation attached to it. One listing suppression, one competitor undercut, one bad review cycle, and your revenue collapses.
Content sites monetized through AdSense require you to verify both the traffic numbers and the monetization rate. Ask for a linked read-only Google Analytics 4 and AdSense account view.
The cross-reference check: take total monthly sessions from GA4, apply the reported RPM, and see if it matches the reported AdSense revenue. If the math doesn't work, ask why.
Red flag: An RPM above $15 for a general niche content site. Finance and legal niches can legitimately hit $20–$40 RPM, but a lifestyle or hobby site claiming $18 RPM deserves scrutiny. Bot traffic inflates session counts without generating real ad revenue — the RPM deflates, not inflates, when sessions are fake. So high RPM with high traffic often means real traffic but inflated revenue reporting.
PayPal is harder to verify than Stripe because the export formats are less standardized. The most reliable approach:
Red flag: A high volume of refunds and disputes visible in the activity feed. PayPal's buyer protection is aggressive — a business with a chronic dispute rate has a customer satisfaction problem that will follow you post-acquisition.
For Shopify-based ecommerce businesses, request Shopify Partners read-only access or conduct a live screen share. The critical views:
After verifying the payment processor data directly, add an independent layer of verification using third-party tools that the seller has no control over.
Never accept P&L spreadsheets alone. They take 10 minutes to fabricate. Always cross-reference against the raw payment processor data — a P&L should be a summary you verify, not a document you trust.
The final layer of verification connects the payment processor data to the actual bank account. Request 12–24 months of business bank statements and work through the following:
For acquisitions above $250K, consider using a third-party bank verification service like Plaid or hiring an M&A accountant to formally validate the bank statements. The cost is minimal relative to the deal size.
If you're buying through a broker, it's tempting to assume the vetting has already been done. Here's the reality of what the major brokers actually verify:
Broker vetting is a first pass, not a guarantee. Your diligence is your responsibility.
Empire Flippers' vetting is the strongest in the industry for the $50K–$2M range. But even verified listings require your own independent verification of platform-level data. Browse Empire Flippers verified listings →
Before signing an LOI, confirm you've completed each of the following:
Run the deal through our analyzer — it surfaces revenue concentration risk, traffic single points of failure, and generates the due diligence questions that matter most for your specific deal type.
Analyze a Deal FreeA motivated seller with clean books will do every single thing on this list without friction. They want the deal to close. Resistance — delays, partial access, "I'll send you a summary instead" — is almost always a signal worth heeding.
The buyers who get burned aren't careless people. They're buyers who trusted impressive documentation instead of following the process through to the raw data. The process exists because screenshots lie and spreadsheets are easy to fake. Raw payment processor data, matched to bank statements, matched to third-party traffic estimates, is the only foundation worth building a purchase on.