Fraud in Website Acquisitions

4 Website Due Diligence Mistakes That Burn Buyers Daily

Due diligence is a tricky subject and one that can’t be very easily taught or learned, making many buyers choose to leave it to professionals instead. But there are a number of simple but crucial things that everyone who’s thinking of buying a website or an online business is better off knowing themselves. In this article, I’ll cover the 5 arguably most common mistakes that are often made by buyers new to the industry and some experienced buyers alike.


Mistake #1 – Taking Traffic and Revenue Proofs at Face Value

This is perhaps the most common mistake made in the industry, although primarily for smaller purchases that are facilitated by marketplaces, rather than brokers – but also some less established or less legitimate brokers.

I’ve said it before and I’ll say it again – NEVER trust a screenshot or a video walkthrough, unless the purchase price doesn’t exceed what you’d spend on dinner tomorrow. There should be absolutely no exceptions to this rule, ever.

The reason? Because it takes someone with basic computer knowledge no more than 15 minutes to put together convincing (and I mean convincing – ones that would fool a seasoned expert) package of screenshots and video proofs showing — whatever they want them to show.

If there’s any interest in the comments then I’ll post a follow-up video post showing and proving how blatantly easy it is to put together “proofs” that appear to accomplish the majority of listings – even 5- and 6-figure ones – throughout online marketplaces.

So what should you do instead?

Always insist on live verification. And I don’t mean meeting with the seller face to face as this would, in most cases, be unfeasible. Most of the times either a simple Skype call accompanied by screen sharing (Skype’s built-in feature), or alternatively a traditional call combined with a screen sharing solution, such as ScreenLeap or TeamViewer – there are lots of good and free solutions out there – will do the trick just fine.

What you’re looking for is a couple of things:

  1. Live Account Access. You want the seller to walk you through their revenue accounts, one by one, to demonstrate that the claimed revenue actually exists.
  2. Log-in sequence. A crucial part of a live verification session is having the seller “click around” within the sites that are being demonstrated, as well as go through a full log-out / log-in sequence. It’s very easy to artificially change some parts of a site and make them appear as the scammer wishes, but it’s much more difficult (albeit not impossible) to replicate the whole login process.
  3. Prompting the unexpected. Whenever I perform revenue verification myself, I make sure to prompt the seller to show me something that wasn’t talked about before, in order to try and catch the scammer off-guard. This can be anything – from a remote and irrelevant part of a site (e.g. “Please show me the ‘profile’ section in your PayPal account”) to random periods.
  4. Double Verification. Always aim for double verification when it comes to revenue. Double verification means that you’ll follow the money as it flows, e.g. for a site that receives its revenue via PayPal, you’ll want to see both the PayPal account, as well as the bank account into which these payments are withdrawn to make sure that it belongs to the same person.

For traffic verification, it’s a little easier. Simply request the seller to grant you live guest access to the site’s Google Analytics and you’re all set. Many sellers (/scammers) tend to come up with all sorts of excuses for why this isn’t possible but during my years in the industry, having overseen several hundred transactions, I’m yet to encounter one legitimate one for the lack of the ability to add me to Google Analytics as a guest user.

No Google Analytics? Ask the seller to put it up, let it gather data for a few days, then verify. Again, no exceptions.


Mistake #2 – Assuming that Revenue Means Site Revenue

I’ve written about this one already about a year ago so let me just give you a quick summary.

Many scammers out there are able to run their ‘businesses’ because they happen to have one (legitimate) revenue generating site, the earnings of which they present as the earnings of the multiple sites that they sell each month. The danger is that since the *person* does have legitimate earnings, they’re more than happy to go through live revenue verification with you and demonstrate the earnings – only the earnings are not generated by the site that’s being sold and will therefore be zero the moment the site is taken over.

So what should you do instead?

  1. Always try to establish a clear link between the revenue account and the site in question.
  2. Make sure that traffic levels correspond to revenue levels. If it’s quacks like a duck ……
  3. Perform a thorough background check on the seller.

Check out my earlier write-up about this for some more specific pointers and explanations.


Mistake #3 – Not Verifying Traffic Sources

Another easy way to fall prey for scammers is naively assuming that all traffic is good traffic – not so.

When analysing your acquisition candidate’s traffic details, it’s extremely important to pay close attention to traffic sources, and make sure that they’re:

  1. Verifiable. This means, essentially, to stay away from sites that have an abnormally large share of Direct Traffic, which by its nature is in no way verifiable.
  2. Sustainable. Does the site that you’re looking at get most of its traffic from a single Buzzfeed or Reddit post? Run! Does the site get a large share of its traffic from another site who’s linking out to it out of ‘goodwill’ (and may even be owned by the same person)? Run faster!

Think of traffic sources like the physical location of your Bricks & Mortar business. Having your cupcake shop in the middle of a busy street is great, as the street is likely to stay busy for years to come. But having it in next to the (remote and otherwise rarely used) football stadium where the next big one-off game is going to be held? Great for one night – after that, bad news.

I’ve also blogged about this topic in greater length – see here: How Traffic Sources Affect Website’s Value and Longevity


Mistake #4 – Not Verifying Organic Traffic

Some scammers make a good living out of selling sites that get all its traffic from paid sources (such as Google Adwords), but passing it on as organic traffic.

Those sites typically make very little to no money and most of the times generate a loss if ad costs were to be deducted, but for the scammer it’s good business, as they’re claiming that the site gets organic traffic and has no ad costs.

And what’s worst – Google Analytics is their accomplice!

What many people don’t know or realise is that Google Analytics doesn’t distinct clicks that originate from Google’s organic search results from clicks that come from paid Google AdWords ads, unless the Analytics and Adwords accounts are linked . Because of this – sites like those that I’ve described above, often show up as if they were receiving lots of organic traffic, whereas in reality it’s all paid AdWords traffic.

How to verify organic traffic

Fortunately, verifying whether traffic that shows as ‘Google/Organic’ is truly from search results is relatively simple. Personally, I use a combination of 3 checks/tools for this:

  1. allows you to punch in a random web address, and it will show you the likely organic traffic levels (and a list of keywords) that the site receives. Note that SEMRush is not 100% accurate, but it’s usually not too far off either – so if SEMRush shows virtually no traffic or ranking but Google Analytics shows loads then it’s highly likely that something is wrong.
  2. is a neat little tool that allows you to check whether a particular site is advertising on Google Adwords, as well as estimate their approximate ad budget. Even though the budget figure that KeywordSpy shows is often quite far off from the reality, one thing is certain – if KeywordSpy shows ANY ad spend then ad spend exists. Meaning that if the seller is claiming no ad spend then you should do yourself a favour and more on to the next acquisition.
  3. Google is the best tool of all. Simply go to Google and search for the keywords that the site is likely to rank for, trying to find whether the rankings exist or not. Then head over to Google Keyword Planner to estimate the ‘average monthly traffic volume’ for those keywords.

There are also other methods of verifying organic rankings, such as connecting Google Analytics to Google Webmaster Tools, but that’s not the scope of this article and won’t apply retroactively.

Over to you

I truly enjoy a good discussion so do let me know in comments if you have anything to add to the above.

Also let me know if you’re keen to see a ‘live fake revenue’ demonstration and I’ll put it together for the next post!

P.S. I’ve also just launched a (rather self-destructive) Free Website Valuation Service, as well as published 13 thorough Website Broker Reviews, covering the majority of the brokerage world! Check them out and let me know of your thoughts. Any feedback is hugely appreciated.

Share this!