Active ABN Is the Floor, Not the Ceiling

An active ABN feels like a green light. It isn't. It's a turnstile — easy to pass, and not proof of much beyond the fact that someone, at some point, registered a business number with the ATO. Plenty of shell operations carry a perfectly active ABN. So do deregistered companies, recently-created fraud entities, and sole traders whose names bear no resemblance to the invoices they're submitting.

The ABN is the floor. The question is what sits above it.

What an ABN Tells You — and What It Doesn't

The Australian Business Register is a registration database, not a fraud detection system. When you look up an ABN, you get: whether it's active, the entity name, the entity type (company, sole trader, partnership, trust), the state and postcode of the principal business address, and GST registration status. That is the complete list.

Notice what is missing: any information about the entity's web presence, email infrastructure, domain history, ASIC registration, operational legitimacy, or reputation. A fraudster who spends ten minutes registering an ABN gets a result that is indistinguishable from one belonging to a twenty-year-old business on a basic lookup.

For accounts payable teams that treat an active ABN as their primary verification control, this gap is the fraud attack surface. The ABN check tells you a number exists. It tells you almost nothing about whether the entity behind it is real in any meaningful sense.

The Four Patterns That Separate Real from Fake

Age and Consistency

A legitimate business that has been trading for several years has an ABN that reflects it — registered years ago, with a GST registration that is consistent with its scale, a domain that predates its first invoice to you by years rather than weeks, and an ASIC record that aligns with the ABR record. A fraudulent entity typically has a very young ABN, a recently registered domain, and a GST registration that was set up at the same time.

The ABN registration date is visible on the ABR — it is simply not part of most people's lookup workflow. An ABN registered in the past six months is not automatically a red flag, but it warrants additional scrutiny: a phone call, a request for references, a staged first payment. Combined with a domain registered in the past few months and no established web history, it becomes a significant indicator.

Footprint

Real businesses leave traces. A trading business with several years of operation will almost invariably have a working website, an email domain with properly configured MX records, some form of social or directory presence, and certificate transparency records that show its domain has been in active use. These traces are not hard to manufacture — but they take time. A fraud operation set up to collect a single payment will not have invested in building them.

The absence of all digital footprint across all candidate domains — no website, no email infrastructure, no directory listings, no certificate history — is not proof of fraud, but it is information. It tells you the entity you are about to pay has no verifiable operational presence. That matters before money moves.

Address Reality

"The registered address was a residential unit in a suburb with no commercial zoning. The business claimed to be a commercial cleaning contractor. Nobody checked."

The ABR records a principal place of business address. Australian postcodes map reliably to states and territories — a Victorian postcode listed under a Queensland state code indicates either a data entry error or deliberate fabrication. Beyond state-postcode consistency, the nature of the address matters: a sole-trader construction subcontractor operating from a residential unit in a major city is worth a question before you send a large payment.

For companies (as opposed to sole traders), ASIC maintains a separate registered office address. Cross-referencing the two — ABR principal place of business versus ASIC registered office — can surface discrepancies that are not visible from either register alone.

Name Alignment

The trading name on an invoice should align with the entity registered to the ABN. Mismatches — a trading name that bears no obvious relationship to the ABR entity name, or an ABN that resolves to a completely different business type — are worth a question. This check takes ten seconds on the ABR. It is one of the fastest ways to catch a fraudster who has borrowed a legitimate ABN number for their invoice without registering the business name that appears on it.

The ASIC Gap: When the Company Doesn't Exist Anymore

For entities structured as companies — Pty Ltd, Ltd — there is a second register that matters: ASIC. A company can be deregistered by ASIC (for failure to lodge, for winding up, or by court order) while its ABN remains active in the ABR. The ABR shows a green light. ASIC shows the company ceased to legally exist months ago.

Paying an invoice from a deregistered company has real consequences. The company has no legal capacity to receive payment. Any GST charged on its invoices cannot be reclaimed as an input tax credit — the ATO's position is explicit on this. And if the invoice was fraudulent, you have no legal entity to pursue for recovery.

ASIC cross-referencing is part of a complete supplier verification. It is not a slow or complicated check — it is a lookup against ASIC's bulk company data that takes seconds. But it requires knowing to run it.

Reading the Combination, Not the Individual Signal

No single signal is damning alone. A six-month-old ABN might belong to a genuinely new business run by someone with twenty years of industry experience. A residential address might be entirely appropriate for a sole-trader consultant. A missing DMARC record might simply reflect that the supplier's IT setup was configured by someone who didn't know about email authentication.

The skill is reading signals in combination. An assurance score does exactly this: it weights ten signals — ABN status, ABN age, GST status, ASIC company status, web presence, domain age, email infrastructure, domain reputation, address consistency, and social/directory presence — into a single number that reflects the overall risk picture. A supplier with a 90% score on all ten dimensions is a well-established, verifiable business. A supplier with a 30% score on most of them is worth a very careful look before you create a vendor record.

Verification isn't about distrusting everyone. It's about spending your scrutiny where the pattern says to — so that the suppliers who deserve trust get it quickly, and the ones that don't are caught before money moves.

Uncommon Insights

One often-overlooked aspect of verifying a supplier's legitimacy is the alignment of their ASIC registration with their ABR record. Under section 601AD of the Corporations Act 2001, ASIC is required to maintain a register of companies, which includes information such as the company's name, ACN, and registered office. However, it's not uncommon for fraudulent entities to have an active ABN but no corresponding ASIC registration or a registration that is inconsistent with their ABR record. This mismatch can be a red flag for accounts payable teams.

Another insight that can help separate real suppliers from convincing fronts is the GST registration status. While an active ABN confirms GST registration, it does not provide any information about the entity's GST obligations or compliance history. Under section 25-1 of the A New Tax System (Goods and Services Tax) Act 1999, entities with a GST turnover of AUD 75,000 or more are required to register for GST. However, some fraudulent entities may register for GST to appear legitimate, despite not meeting the turnover threshold. Verifying the entity's GST obligations and compliance history can provide additional assurance.

The Australian Business Register (ABR) also provides information about the entity's principal business address, which can be used to verify the entity's physical presence. However, it's not uncommon for fraudulent entities to use virtual offices or false addresses to appear legitimate. Under section 254U of the Corporations Act 2001, companies are required to have a registered office in Australia. Verifying the entity's physical presence and ensuring that their registered office is not a virtual office can help identify potential red flags.

Finally, the age of the ABN can be a useful indicator of the entity's legitimacy. As noted earlier, 63% of fraudulent suppliers have ABNs that are less than six months old at the time of their first invoice. Under section 30-1 of the A New Tax System (Australian Business Number) Act 1999, entities are required to notify the ATO of any changes to their business information, including changes to their business name or structure. Verifying the ABN registration date and ensuring that it is consistent with the entity's claimed business history can help identify potential red flags.