Most buyers lose money not because they overpaid, but because the business they bought never existed the way it was presented. Fabricated revenue screenshots, purchased traffic, and hidden liabilities cost acquisition buyers hundreds of thousands of dollars every year. Here is exactly how each scam works — and the verification steps that stop it cold.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
There is a difference between a seller who is bad at bookkeeping and a seller who is deliberately lying to you. The first one is common, annoying, and usually fixable during due diligence. The second one is a crime, and it will empty your bank account if you do not know what to look for.
I have reviewed thousands of listings across marketplaces and broker platforms. The overwhelming majority of sellers are honest people who want a clean exit. But the fraudulent minority are disproportionately good at getting attention, because a fabricated business always looks better than a real one. Fake numbers have no bad months. Fake traffic never dips. Fake email lists never churn. When a listing looks perfect, that is not a green flag — that is a data point that requires explanation.
This post walks through the five fraud patterns I see most often, how each one is constructed, and the specific verification step that breaks it. None of these checks require a forensic accountant. They require about four hours of your time and a willingness to be the annoying buyer who asks for one more thing.
This is the oldest scam in the online business world and it still works because most buyers are not trained to distrust a picture. The seller sends a Stripe dashboard screenshot showing $14,200 in monthly volume, a PayPal summary, or a Shopify analytics page. The layout is correct. The fonts match. The date range matches the period they claimed. And the numbers are entirely made up.
Editing a screenshot takes about nine minutes in Canva or Photoshop. You do not need to be a designer. You need to match a font, replace a few digits, and export a PNG. Some fraudsters go further and use browser developer tools to edit the live page before capturing it, which produces a pixel-perfect fake because it is the real page — with the numbers rewritten in the DOM. I have seen fake Stripe screenshots that included realistic dispute counts and refund lines, because the seller knew that a dashboard with zero refunds looks suspicious.
The detection method is simple and non-negotiable: never accept a static image as financial proof. Request a live screenshare session where you watch the seller log in and navigate the actual platform in real time. Ask them to change the date range while you watch. Ask them to click into a specific transaction. Ask them to filter by refunds. A fraudster with a doctored screenshot cannot survive thirty seconds of live navigation. Better still, ask to be added as a read-only collaborator on Stripe, Google Analytics, or the ad platform. Stripe supports read-only team members. Google Analytics supports viewer access. Shopify supports limited staff accounts. A legitimate seller who is already under LOI will grant this. A fraudster will produce excuses about privacy, competitors, or their accountant.
One more layer: reconcile platform revenue against bank deposits. Stripe payouts land in a bank account with matching amounts and dates. Ask for three months of bank statements — PDF originals, downloaded directly from the bank during your screenshare, not files emailed to you — and match at least twelve individual payouts line by line. If the Stripe dashboard says $14,200 and the bank shows $4,900 in deposits, you have your answer.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
Traffic is easier to fake than revenue because you can buy it legitimately for pennies. Click farms, traffic exchange networks, and bot services will send 100,000 sessions to a website for a few hundred dollars. Google Analytics dutifully records every one of them. The seller then presents a listing showing a content site with impressive-looking traffic growth and a story about untapped monetization potential.
The tell is always in the behavioral metrics and the ratios. Purchased traffic behaves nothing like human traffic. Bounce rates run above 90 percent, often above 95. Average session duration collapses under ten seconds. Pages per session sits at exactly 1.0. Geographic distribution looks strange — a supposedly US-focused personal finance blog with 40 percent of sessions from a country where nobody would search those terms in English. And the traffic sources are suspiciously clean: either 100 percent direct traffic, or referral traffic from domains you have never heard of that do not appear in any backlink tool.
The ratio test is the fastest one. A display-ad content site earning $500 per month on 100,000 monthly sessions has an RPM of $5. That is plausible for some niches, but if the site is in a high-value vertical like finance or insurance, an RPM that low is a red flag. Run the same test in reverse: if the site claims 100,000 sessions and $500 revenue, but the niche typically produces $25 RPM, real traffic would be closer to 20,000 sessions. The other 80,000 are fake. This anomalous revenue-to-traffic ratio is exactly the pattern that Deal Alert AI scores automatically across live listings, because it is a mathematical relationship that fraud cannot hide.
This one is more sophisticated because the revenue is real. The seller spends four to six months running aggressive paid acquisition, deliberately operating at breakeven or a loss, purely to inflate the trailing twelve-month revenue figure. Then they list the business at a multiple based on the last six months of "growth" and exit before the ad spend catches up with them.
Here is what it looks like in practice. A Shopify store does $8,000 per month for eighteen months. The owner then spends $30,000 on Meta ads over five months, driving revenue to $22,000 per month. They list the business citing "recent months annualized" at $264,000 in revenue and ask for a 3.5x multiple on inflated SDE. The buyer takes over, turns off the unprofitable ad spend because it was never contributing profit, and revenue reverts to $8,000 within sixty days. The buyer paid for a business that does not exist.
The defense is data depth. Always request twenty-four months of financial data, not twelve. Twelve months is the industry default precisely because it hides this pattern. With twenty-four months, an engineered spike becomes visually obvious: a flat baseline followed by a sharp hockey stick in exactly the period before listing. Then ask for the corresponding twenty-four months of ad spend, broken out by channel. Calculate contribution margin per month. If revenue grew 175 percent while net profit stayed flat or declined, the growth was purchased, not built.
Legitimate spikes do exist. Seasonality is real — a gift-focused ecommerce brand doing 40 percent of annual revenue in Q4 is normal. A viral TikTok moment is real. A successful new product launch is real. The difference is that a legitimate seller can explain the spike with specifics, show you the mechanism, and demonstrate why it is durable. A fraudster gives you vague answers about "improved marketing" and pushes you to close quickly.
"50,000 email subscribers" appears in listing after listing as a headline asset. In many cases that number is technically true and economically worthless. The list was purchased, scraped, built through incentivized giveaways that attracted freebie hunters, or accumulated over eight years with no cleaning. Deliverability is destroyed, open rates sit under 4 percent, and the sending domain may already be flagged by major inbox providers.
Worse, some sellers simply fabricate the engagement metrics in a slide deck. They report "38 percent open rate" with no supporting evidence, knowing most buyers will not ask for proof. Email is treated as a soft asset, so buyers scrutinize it less than revenue — which makes it the easiest place to inflate perceived value.
The verification is direct: request screenshare access to the email service provider dashboard — Klaviyo, ConvertKit, Mailchimp, Beehiiv, whatever they use — and review the actual campaign report for the last twenty sends. Not a summary. Not an average. The individual campaign reports, with unique opens, unique clicks, unsubscribes, bounces, and spam complaints. Then check the list health: how many subscribers have engaged in the last 90 days? A 50,000-person list with 3,000 active engagers is a 3,000-person list. Price it accordingly.
Also check the acquisition source and consent trail. If the list was built through a giveaway or purchased, you may be inheriting a GDPR or CAN-SPAM liability along with the subscribers. Ask when each segment was added and through what opt-in mechanism. If the seller cannot answer, assume the worst and value the list at zero.
The most expensive fraud is not about inflating assets. It is about hiding what you are actually buying. Outstanding supplier debt. An unresolved trademark dispute. Content that was lifted from a competitor and is one DMCA complaint away from deindexing. An Amazon account with a suspension history and two active policy strikes. A Google AdSense account under manual review. A pending chargeback wave from a product that did not ship.
These do not show up in a P&L. They show up ninety days after closing, when the platform suspends the account or the lawyer's letter arrives. And because the asset purchase agreement was drafted by the seller's attorney, you may find you assumed the liability without realizing it.
The investigation is more manual but not difficult. Search the business name, brand name, and domain on Google with modifiers like "scam," "lawsuit," "complaint," and "refund." Check the Better Business Bureau, Trustpilot, and Reddit. Run the domain through Ahrefs and check for sudden traffic collapses that correlate with algorithm updates or manual actions — a site that lost 70 percent of traffic in a single week two years ago has a history worth understanding. Check the Wayback Machine to see what the site looked like previously; sudden total redesigns and niche pivots often follow penalties. For Amazon businesses, request the full Account Health dashboard on screenshare, including performance notifications and policy warnings going back at least a year.
Finally, have an attorney review every contract that transfers with the business: supplier agreements, affiliate contracts, software licenses, contractor agreements, and any outstanding loans. Marketplaces like Empire Flippers vet sellers before listing, which meaningfully reduces exposure to the crudest forms of fraud. Open marketplaces like Flippa offer far more inventory and better prices for diligent buyers, but the verification burden shifts to you. Neither model eliminates the need for your own investigation.
Print this. Run it on every deal before you sign an LOI, and finish it before you wire funds. Each item exists because I have seen a deal go wrong when it was skipped. The whole list takes about four to six hours for a typical six-figure business, which is a reasonable investment against a six-figure loss.
Do not let a seller talk you out of any single item. The excuse is always the same — "other buyers didn't ask for this," "I'm not comfortable sharing that," "we need to move fast." Urgency is the fraudster's primary tool. Any deal that cannot survive one week of verification is a deal you should not be in.
The checklist above is thorough, but it is also expensive in time. You cannot run six hours of verification on every listing you encounter — you would burn a full week on four deals and still not have an offer out. The practical approach is a two-stage funnel: automated screening first to eliminate obvious problems, then deep manual verification on the two or three deals that survive.
That is the specific problem Deal Alert AI was built to solve. The system continuously scores live listings across Empire Flippers, Flippa, and other marketplaces, flagging the mathematical inconsistencies that fraud produces: revenue-to-traffic ratios outside normal ranges for the niche, revenue curves showing a flat baseline with a sharp pre-listing spike, traffic growth that does not correlate with any backlink or content activity, multiples priced far below comparable deals with no disclosed reason, and listings where claimed metrics conflict with publicly observable data like Ahrefs traffic estimates.
None of these flags prove fraud. A flag is a question, not a verdict. Plenty of legitimate businesses have unusual ratios for perfectly good reasons — a high-ticket B2B service with low traffic and high revenue will look anomalous on paper and be completely real. The value of automated scoring is that it tells you which question to ask first, so your six hours of diligence go toward resolving the actual risk instead of methodically checking things that were never in doubt.
Used correctly, this is how a part-time buyer competes with full-time acquisition firms. You are not outworking them on volume. You are letting software handle the pattern recognition across hundreds of listings, then applying focused human judgment where it actually matters. Deal flow tracking, anomaly scoring, and comparable multiples data are all available inside Deal Alert AI, and they exist specifically so you spend your diligence budget on real deals.
If your verification turns up something that does not add up, resist the urge to confront the seller with an accusation. Ask a neutral, specific question instead. "I'm seeing 80,000 organic sessions in Analytics but 6,000 clicks in Search Console for the same period — can you help me understand the gap?" An honest seller with a technical explanation will provide it immediately. A fraudster will become defensive, vague, or aggressive about your timeline.
If the answer does not resolve the discrepancy, walk. Do not negotiate a discount on a business you cannot verify. The instinct to salvage the deal after investing twenty hours is powerful and it is exactly how buyers lose money. Sunk cost is not a reason to wire funds. There are thousands of listings live at any moment; you will find another.
Report what you found. If the listing is on a brokered platform, contact the broker directly with your evidence — reputable brokers act on this, because fraudulent listings damage their entire business model. If it is on an open marketplace, use the reporting function and include specifics. If you have already sent money, contact your escrow provider immediately, then your bank, then a lawyer. Speed matters enormously in recovery. And if the fraud involved wire transfer outside escrow, file with the FBI's IC3 in the US or the equivalent authority in your jurisdiction.
The uncomfortable truth is that most fraud in this market succeeds because buyers are in a hurry and emotionally committed before they verify. The discipline that protects you is not intelligence — it is sequencing. Verify first, get excited second. Every experienced acquirer I know learned that lesson the expensive way, and the entire point of writing this down is so you do not have to.
By Sophal Lanh, Founder of Deal Alert AI
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.