A homepage that says "1,000+ projects delivered, 250 experts, clients in 40 countries" is making three statements you can check. It is easy to read them as decoration. They are worth reading as claims, because the way a company describes itself is the first evidence you get of how it will describe its progress on your project.
This article covers IT company red flags in marketing: the numbers, faces, badges, logos and reviews a company shows on its own website, and how to check each one in a few minutes. It sits alongside our piece on red flags in contracts, payments and the build itself, which picks up once you are talking to a vendor.
One principle before the list. A claim you can't verify is not automatically false. Plenty of honest work is covered by an NDA. What matters is what happens when you ask: a company with real work behind its claims answers specifically, and one without it gets vague.
IT company red flags in the numbers
"1,000+ projects" next to a portfolio of a handful
Do the arithmetic. A company founded eight years ago that claims 1,000 projects has delivered about 125 a year, which is two or three every week without a break. That is possible for a firm doing small website jobs at volume. It is hard to square with a portfolio page of nine projects and a team page of fifteen people.
How to check: count the portfolio entries and open every link. Then ask for five projects from the last two years that resemble yours and that you can open or install. If a company can't show five out of a claimed thousand, the thousand is not telling you anything.
"Clients in 40 countries"
The same test applies. A company with clients in 40 countries can name a few of those countries and point to work for a client in at least one. Ask which countries and which projects. If every one of the 40 is confidential, the number can't help you decide.
Faces and voices you can't trace
A team page built from stock photos
A polished team page can be a set of stock images with invented names and titles.
How to check: search with the image itself. In Chrome, right-click a photo and choose "Search with Google Lens". Google's help page on searching with an image says the results include websites with the same or a similar image. If the "head of engineering" also appears on a stock photo site and on unrelated company websites, you have your answer. More useful still, ask to meet the people who would work on your project on a video call. If you are hiring dedicated developers rather than buying a finished project, interview the actual individuals before anyone starts.
Testimonials with a first name and nothing else
"Great team, delivered on time. Rahul, CEO" could be anyone. A testimonial worth reading names the person, the company and the project, and you can find all three.
How to check: search for the person and the company. If neither turns up, ask for a reference call with a past client whose project resembles yours. Some clients ask not to be named. An honest company says so plainly and offers another way to confirm the work.
Credibility borrowed from other brands
A wall of famous logos
A "trusted by" strip of large brands costs nothing to put on a website. Sometimes it is true in a narrow sense: a developer once handled a small task as a subcontractor, or a staff member worked with that brand in a previous job.
How to check: for each logo, ask what was built, for which team, in which year, and whether the work was direct or through another agency. A logo with no case study behind it tells you nothing about what the company can do for you.
Partner badges
Badges from Google, AWS or Shopify mean something specific, and each program has a public directory.
How to check: search for the company in the Google Partners directory, the AWS Partner Solutions Finder or the Shopify Partner Directory. Check the tier as well as the listing. The Google Partners directory, for example, shows Premier Partners by default and lets you filter to see other partners, so "Premier Partner" and "Partner" are easy to tell apart. The AWS and Shopify directories mainly list partners above the entry tier, so a company at the basic level of those programs can be a genuine member and still not appear. If the company is missing, ask which tier it holds and how you can confirm it.
Certifications
A claim such as "ISO/IEC 27001 certified" says an accredited body has certified the company's information security management system.
How to check: search IAF CertSearch, a global database for validating accredited management system certifications. It relies on data from participating certification and accreditation bodies, so if a certificate isn't there, ask for a copy, the name of the issuing body and the dates, and confirm with that body. Watch the wording too. "Aligned with" or "follows" a standard is a different claim from holding a certificate.
Rankings, awards and reviews
A self-awarded "No. 1"
"No. 1 software company in India" on a company's own homepage, or a top 10 list on its own blog with itself in first place, is a ranking with no judge.
How to check: ask who ranked it and by what method. If the answer leads back to the company's own website, set the claim aside. Our guide to reading lists of top software companies has a short routine for checking any published ranking.
Awards
An award is only as meaningful as whoever gives it.
How to check: find the award on the awarding organization's own website, confirm the company appears among the winners for the year claimed, and read what was judged. Some awards require an entry fee or a paid package. That doesn't make them worthless, but it changes what they tell you.
A burst of near-identical five-star reviews
Twenty glowing reviews posted in the same week, in similar words, from profiles with little other activity, is a pattern worth noticing. Google's fake engagement policy for Maps prohibits reviews "that have been paid for, directly or in kind" and content posted from multiple accounts by or at the request of one person.
How to check: read the most recent reviews rather than the ones shown first, look at the dates, and open a few reviewer profiles to see what else they have reviewed. People can restrict their Maps profiles, so one hidden profile proves nothing. A cluster is different. Then read how the company replies to its critical reviews, because that shows you how it handles a complaint.
A company older than its website
"15 years of experience" on a domain registered 18 months ago doesn't add up unless the company has rebranded. Neither does a website with no legal name, registered address or company number anywhere on it.
How to check: look up the domain's registration date with ICANN Lookup, look at the earliest captures of the site in the Wayback Machine, and find the company's incorporation date in the public registry. Then ask. A business that traded as a partnership or under another name before incorporating has a real answer. The full routine, including India's MCA and GST searches, is in our guide to verifying a software company in an afternoon.
One homepage, checked in 40 minutes
Say a company's homepage makes six claims: "No. 1 IT company in India", "1,200+ projects", "15 years of experience", "250+ experts", "ISO/IEC 27001 certified" and "Google Premier Partner". Here is what 40 minutes of checking might turn up:
- No. 1: the only source is a list on the company's own blog.
- 1,200+ projects: the portfolio has 16 entries, and 10 of the links open.
- 15 years: the company was incorporated six years ago, and the domain is seven years old.
- 250+ experts: the team page shows 12 people, and an image search finds four of them on stock photo sites.
- ISO/IEC 27001: a valid certificate appears in IAF CertSearch under the company's registered name.
- Premier Partner: the company is in the Google Partners directory, but as a Partner, not a Premier Partner.
One claim is fully true, one is partly true and four don't hold up as written. That doesn't prove the company can't build your software. It tells you that its marketing overstates, and that you should expect to check its status reports with the same care. Put each gap to the company in writing and judge the answers.
What honest claims look like
Honest marketing is less impressive and more specific. It names projects instead of counting them. It shows real people in real roles. It states what it can prove and leaves out what it can't.
That is the standard we hold ourselves to. We don't publish project or client counts, ratings or awards we can't prove, and we don't publish ranking lists with ourselves at the top. Our portfolio shows the projects we actually built, each with a case study, and each entry links to the project's own website where one is public, so you can check the work instead of taking our word for it.
None of these IT company red flags is proof on its own. This week, take the three biggest claims on the website of the company you are most likely to hire and spend ten minutes on each. Put any gaps to the company in writing before you sign.
If you want to test our claims the same way, ask us anything about our work. Every enquiry gets a reply within 24 hours, and you can speak directly to the engineers who would build your project.
