How can I prevent people from pretending to be a business and registering account under their name?

Question

I have a website that allows restaurant owners to register and list their menus. I think I should somehow confirm that a registered account is actually completed by someone associated to the business to prevent some random person from pretending to be a business owner. What is a smooth way to confirm a business? A couple if ideas I have:

• After they register give them a code to post anywhere on their social media. For example, they comment the code "8dsGDFG9231" on one of their old Facebook posts. As long as they link me to the post, I can confirm their business registration. I am going to assume if someone has access to a business social media, the business registration on my site must be legitimate.

• I can manually call the business number. This might scare some businesses away though.

Is there an obvious better solution to confirm a business account on my website?

Answer 1

If the business has its own web domain, you could exchange emails with the user, something along the lines of

• user registers as [email protected]
• you send a link with your “8ds...” code in it to that email address with instructions to click here to complete your registration...
• when that link is hit, you know that Joe was willing to complete the registration.

You can’t simply take an incoming email from Joe as being good enough, since anybody can spoof the sending address (at least to some level of appearance).

This isn’t entirely foolproof unless you can validate that joesdiner.com is in fact the domain associated with the restaurant you are dealing with; a determined impersonater might register a look-alike domain with a .biz or other TLD, and if you or your program were to accept that, there could be issues. If the restaurant has an established website, this risk goes way down.

This approach would probably scale up with automation better than accepting phone calls would.

Answer 2

Let the business choose their method of verification. Offer a fast and automated solution if you can, but also allow them to share their contact info so you can follow up personally.

Why? Restaurants come in all shapes and sizes, and they won't all have the same technical abilities. You will eventually run into someone who doesn't have a Twitter account, or who uses their personal email for all their business accounts. Furthermore, how can you verify that the Twitter account is actually theirs?

---

Make either method easy and friendly. Your code solution sounds like a great, fast option if you are certain the account it is coming from is authentic. While this is off-topic for UX, check out public record to see which data can be used for verification.

For the manual calling method, let the businesses decide which times would be most convenient for you to call them at. To make this process friendlier, use a dictionary to generate the codes, rather than random alpha-numeric characters.