I'm a web developer working on a project for a client. To keep it short, the project has company listings. These company listings are not provided by the companies themselves and instead it is just a part of big data, however companies can choose to claim their profiles. However, now I run into the problem of how to verify if the user claiming the company is indeed from the company. By default, we have the company's email whether it is claimed or unclaimed. I can always send an email to that address with a verification token to claim the company. However what if that email is incorrect in our database or no longer in use? I can't let the user enter the email himself else anyone can claim any company. Does anyone have a solution to this problem? Would enforcing the domain of the email be enough? As in, suppose someone was claiming McDonald's as a company, would enforcing McDonalds.com in the email be enough? Does anyone have a better idea?
-
If it's a US based organization, you can ask for the business EIN– RubberStampJan 7, 2019 at 20:57
-
@RubberStamp It's international sadly, but thank you for your help!– TheAliTrixxJan 7, 2019 at 21:12
1 Answer
The most common ways used to verify domain(i.e. company) ownership:
- verifying via a company-owned email that you designate (e.g. webmaster/admin/support@x.y - this helps prevent an employee who is not authorized to claim ownership from doing so)
- verifying via an html tag of some kind in the homepage (or even a whole html page at the webroot)
- verifying via a DNS TXT record for that domain
Ultimately, it will be up to you to ensure that the correct domain is matched to the company. I would recommend that you correlate their live website to the company profile when you create it, so you don't run the risk of someone trying to typo-squat them and then falsely claim the company with that.
For reference, here are a few different examples:
- Google: https://support.google.com/a/answer/6248925?hl=en
- HaveIBeenPwned: https://haveibeenpwned.com/DomainSearch
- ZeroSSL: https://zerossl.com/free-ssl/#howtocrt (check under 'Verification')
Lastly, if they do not have a website, I'd recommend taking a look at Yelp's process for verification: https://biz.yelp.com/support/claiming
I haven't used them specifically, but I believe they allow for 'offline' claiming of a business(and support a process to dispute or "reclaim" businesses in case they're falsely claimed or ownership changes, etc).
-
None of these options verify a company... That's one reason why EV TLS certs generally require that applicants provide government verified business documents. Jan 7, 2019 at 21:49
-
That's true; they don't provide absolute proof of ownership. Most websites don't require that, however, because they're not issuing trust mechanisms the way a CA is. Jan 7, 2019 at 21:51
-
1Verification of a domain owner is not the same as verification of a business owner... if the OP wants whatever product the OP is keeping track of to have any value whatsoever... i.e. trust that the claimant is an authoritative one... then the OP is going to need to verify the business owner regardless of the domain owner. Jan 7, 2019 at 21:56
-
I mean you say that, but Yelp(who is clearly worth a lot of value) would seem to indicate otherwise; they apparently use the phone # listed on the site as one method to verify ownership. I understand where you are coming from, but I think you are asserting the maximum level of security as the best general rule, when in this case it's probably overkill. Jan 7, 2019 at 22:01
-
Yelp is still not verification of a business. I'm sure Yelp does not guarantee complete accuracy. I imagine, the entire legal department would all suddenly decide that there were other places to work, if Yelp made that guarantee... If OP is <s>spamming</s>... errr... hamming potential clients with possible product that might belong to Company X... then, fine, Yelp is fine... agreed. Jan 7, 2019 at 22:32