Short answer: you can establish who is really behind almost any Indian business in about ten minutes, for free, using seven public sources: the MCA company master data, the GST taxpayer search, domain WHOIS, the app-store developer record, the EPFO establishment search, the site’s own mandatory disclosures under the e-commerce rules, and independent off-site discussion. None of them require a login, a subscription, or a paid data tool.
All seven sources below are public records or public pages. This guide explains how to read them; it does not make claims about any specific company.
Why identity beats reviews
Reviews tell you what an experience felt like. Identity tells you whether there is anyone to hold responsible when the experience goes wrong. Those are different questions, and for a purchase of any size the second one matters more. A company with a verifiable registered identity, a filing history and a payroll has something to lose; that is the entire mechanism by which consumer remedies work.
This is also the check that AI assistants and search engines cannot easily do for you, because most of these records are behind search forms rather than crawlable pages. Ten minutes of manual lookup routinely produces facts that no amount of reading reviews will.
Source 1 — MCA company master data
What it tells you: whether a company or LLP exists, its CIN, date of incorporation, registered office state, authorised and paid-up capital, whether its status is Active, and whether its annual filings are up to date.
How: go to mca.gov.in and use the MCA services search for company/LLP master data. Search the exact registered name from the site’s footer or Terms page.
How to read it: incorporation date gives you real age, which is much harder to fake than a “since 2009” line in a footer. A status other than Active — struck off, under liquidation, dormant — on a company still taking orders is a serious finding. Paid-up capital of ₹1–10 lakh is entirely normal for a small business and is not by itself a warning.
Source 2 — GST taxpayer search
What it tells you: whether a published GSTIN is real, the legal name attached to it, the trade name, the registration date, the taxpayer type, and the current status.
How: gst.gov.in → Search Taxpayer → Search by GSTIN/UIN. No login needed.
How to read it: the legal name returned must match the entity named on the website. A mismatch is one of the strongest signals available — it usually means a GSTIN was copied from somewhere else to look legitimate. A Cancelled or Suspended status on a site that is still invoicing is equally decisive. The first two digits of a GSTIN are the state code, which should be consistent with the address they publish.
Source 3 — domain WHOIS and DNS history
What it tells you: when the domain was first registered, when it was last transferred, the registrar, and the country of registration.
How: any public WHOIS lookup, or the registry’s own service. Registrant details are usually redacted for privacy, but dates are not, and the dates are the useful part.
How to read it: compare the creation date against the claimed founding year. A company that says it has served customers since 2015 on a domain created eight months ago is either rebranding — which is fine and checkable — or inventing history. Also note when a domain changed hands: an old domain recently transferred can mean an expired-domain purchase intended to inherit someone else’s reputation.
Source 4 — app store developer records
What it tells you: for any business with a mobile app, the Google Play and App Store listings publish the developer’s legal name, address and contact email, the first release date, install-count bands, and the full version history.
How: open the Play Store listing and scroll to the developer contact block; on the App Store, open the seller information.
How to read it: the developer name is a disclosed legal identity that has been through Google’s own verification, which makes it a useful cross-check against the MCA record. A long version history with regular releases is evidence of an operating team. An app last updated three years ago on a service the site markets as current tells you where the company’s attention actually is.
Source 5 — EPFO establishment search
What it tells you: whether the employer is registered for provident fund, and broadly whether it has employees on the books.
How: the EPFO public establishment search on epfindia.gov.in.
How to read it: this is a good–news-only signal. A registered establishment with contributions is meaningful evidence of a real operating company. Its absence proves little, because businesses below the statutory employee threshold are not required to register at all. Use it to confirm scale, never to condemn.
Source 6 — the site’s own mandatory disclosures
What it tells you: Indian e-commerce entities are required under the Consumer Protection (E-Commerce) Rules, 2020 to display, among other things, the legal name of the entity, the address of its headquarters, customer-care contact details, and the name, contact and designation of a grievance officer, together with the timeline for acknowledging and resolving complaints. Intermediaries have parallel obligations under the IT Intermediary Guidelines, 2021.
How: read the footer, the Terms of Use, the Privacy Policy and any “Grievance” or “Contact” page.
How to read it: the presence of a named officer with a working email is the point. Test it. An unmonitored grievance address is a compliance page rather than a compliance function, and it tells you what the complaints process will feel like.
Source 7 — independent off-site discussion
What it tells you: what people say where the company cannot moderate them.
How: search the brand name with each of complaint, refund, not delivered, and scam. Add site:reddit.com for unfiltered discussion. Check whether the company responds anywhere publicly.
How to read it: volume is meaningless without a denominator — a large company will always have complaints. What you are reading for is pattern: are the complaints all about one specific failure mode, do they cluster in one time window, and does the company ever engage? A company that publicly answers hard complaints is usually a better bet than one with no complaints at all and no footprint either.
Putting it together
| What you find | Reasonable reading |
|---|---|
| Active company, GSTIN matches, 3+ year domain, grievance officer answers | An established business. Ordinary commercial risk; disputes have a real path. |
| Company exists but filings are overdue and the app is abandoned | Possibly a business winding down. Avoid prepayment, avoid long subscriptions. |
| No entity named anywhere, GSTIN absent or mismatched, domain months old | You cannot identify who you are paying. Do not prepay. |
| Entity real but a different name from the brand | Very common and usually fine — brands trade under names that differ from the registered entity. Confirm the two are linked in the Terms. |
| Everything checks out but reviews are poor | A real company with a service problem. Your remedies work; set expectations accordingly. |
Frequently asked questions
How can I find out who owns a website in India?
Start with the site’s own Terms of Use and footer, which are required to name the operating entity. Verify that name against the MCA company master data at mca.gov.in and, if a GSTIN is published, against the GST taxpayer search. WHOIS will give you the domain’s age even though registrant contact details are normally redacted for privacy.
Is it free to check a company’s registration in India?
Yes. MCA company master data, the GST taxpayer search, the EPFO establishment search and public WHOIS lookups are all free and require no account. Paid company-data services mostly repackage these same public records with a nicer interface.
What does it mean if a company’s GST status is “cancelled”?
It means the registration is no longer active, which can follow from voluntary closure, migration to a different registration, or action by the tax authority. If a business is still issuing invoices with a cancelled GSTIN, that is a substantive problem and worth raising directly before you transact further.
A company is not listed on MCA. Is it fake?
Not necessarily. Sole proprietorships and traditional partnerships are not registered with the MCA at all, and they are perfectly lawful business forms in India. The finding that matters is a mismatch: a site that claims to be a “Private Limited” company but has no MCA record is claiming a status it does not hold.
Where do I complain about an Indian online seller?
Start with the company’s own grievance officer, whose details it is required to publish. If that fails, the National Consumer Helpline on 1915 handles grievances directly, and a formal consumer complaint can be filed online through the e-Daakhil portal. If the matter is fraud rather than a service dispute, use the cybercrime helpline 1930 and cybercrime.gov.in instead, and do it quickly.
How long does this whole check take?
About ten minutes for a first pass. The MCA and GST lookups are under two minutes each once you have the exact registered name, WHOIS is instant, and the off-site search is as long as you want to make it. For any purchase above a few thousand rupees it is the cheapest ten minutes available.
Comments (0)