An unsolicited direct message arrived via Meta Messenger, claiming to represent a cybersecurity and IT services firm seeking an Australian partnership. The pitch was professional in tone — referencing local presence, established clientele, and interest in long-term collaboration. FraudShield-AIT's methodology was applied before any reply was sent.
Active operations in Australia. Established client base including named corporations. A public team of verified professionals. Domain registered and operated locally. Partnership terms available in writing.
No verifiable Australian presence — no ABN, ASIC registration, or office address. One Trustpilot review on record. Fake client logos ("Acme Corp", placeholder brand graphics). Zero named founders or LinkedIn-verifiable team members. Domain registered to a redacted owner in South Africa.
Screening conclusion: The entity presented fabricated social proof, misrepresented its geographic footprint, concealed the identity of its principals, and used unsolicited outreach with no written documentation trail — a pattern consistent with credential fabrication and pre-commitment social engineering. Engagement was withheld pending third-party verification, which was never provided.
FraudShield-AIT evaluates entities across six weighted dimensions. Each dimension is scored independently; the composite risk score is a weighted aggregate. A score above 80 triggers automatic hold pending manual review.
Every partnership pitch, vendor application, or cold-contact inquiry is screened across six layers. Each layer is independent — a pass on layer 1 does not offset a fail on layer 4.
ASIC business registry search, ABN lookup (ABR), and address verification against the claimed local presence. Any unregistered entity claiming Australian operations is an immediate CRITICAL flag.
Founder and director identity check across LinkedIn, company website About Us page, and Google search. Legitimate firms have named, verifiable people. Ghost teams — no names, stock photos, or empty LinkedIn pages — indicate fabricated identity.
Named client references are cross-verified against public data. Logo check against the client's official brand assets — "Acme Corp" and generic placeholder graphics are tell-signs of stock template abuse. Reference calls or email threads are requested as a secondary step.
WHOIS lookup confirms domain registration country, registrant identity (or privacy shielding), domain age, and hosting provider. A domain registered abroad to an anonymised owner, for a company claiming local presence, is a structural mismatch.
Trustpilot, Google Reviews, and industry directories are checked for review volume, diversity, and cross-platform consistency. A single review from a single platform — especially for a company claiming multi-year operations — is an extreme outlier.
The channel, tone, and documentation offered during the outreach is evaluated. Unsolicited DMs with vague partnership terms, no written documentation, and no follow-up email trail match known pre-commitment social engineering patterns.
Red flags are categorised by severity. A single CRITICAL flag is grounds for hold. This entity triggered four CRITICALs and three HIGHs — an exceptional risk profile consistent with organised credential fabrication.
The structure of the outreach is itself a fraud indicator. FraudShield classifies outreach patterns independently from entity data — because a well-structured message from a fabricated entity is more dangerous than an obviously poor one.
Referencing major corporate names without specifics — no project details, no contact names, no verifiable engagement history. Designed to create perceived credibility without checkable claims.
Choosing a personal social channel over email or LinkedIn avoids corporate record-keeping. No email header, no domain trace, no CRM entry. The channel is the tactic.
Asking to "connect" before providing any documentation is pre-commitment social engineering — once a warm relationship is established, verification requests become socially awkward to make.
FraudShield's verdict is binary for entities in the CRITICAL risk band: hold engagement pending verified third-party documentation. In this case, verification was requested. It was never provided.
Before you reply to the next cold pitch, supplier approach, or partnership offer — run it through FraudShield. 47 indicators. Six dimensions. Under 300ms. No gut feel required.