I'm a web developer working on a project for a client. To keep it short, the project has company listings. These company listings are not provided by the companies themselves and instead it is just a part of big data, however companies can choose to claim their profiles. However, now I run into the problem of how to verify if the user claiming the company is indeed from the company. By default, we have the company's email whether it is claimed or unclaimed. I can always send an email to that address with a verification token to claim the company. However what if that email is incorrect in our database or no longer in use? I can't let the user enter the email himself else anyone can claim any company. Does anyone have a solution to this problem? Would enforcing the domain of the email be enough? As in, suppose someone was claiming McDonald's as a company, would enforcing McDonalds.com in the email be enough? Does anyone have a better idea?
The most common ways used to verify domain(i.e. company) ownership:
- verifying via a company-owned email that you designate (e.g. firstname.lastname@example.org - this helps prevent an employee who is not authorized to claim ownership from doing so)
- verifying via an html tag of some kind in the homepage (or even a whole html page at the webroot)
- verifying via a DNS TXT record for that domain
Ultimately, it will be up to you to ensure that the correct domain is matched to the company. I would recommend that you correlate their live website to the company profile when you create it, so you don't run the risk of someone trying to typo-squat them and then falsely claim the company with that.
For reference, here are a few different examples:
- Google: https://support.google.com/a/answer/6248925?hl=en
- HaveIBeenPwned: https://haveibeenpwned.com/DomainSearch
- ZeroSSL: https://zerossl.com/free-ssl/#howtocrt (check under 'Verification')
Lastly, if they do not have a website, I'd recommend taking a look at Yelp's process for verification: https://biz.yelp.com/support/claiming
I haven't used them specifically, but I believe they allow for 'offline' claiming of a business(and support a process to dispute or "reclaim" businesses in case they're falsely claimed or ownership changes, etc).