Fraud in SaaS listings is rarely crude. Nobody invents a business from nothing — they take a real product with modest numbers and make it look like a better one. The signals below are the specific ways that is done, and each has a check that takes minutes.
Revenue Signals
Revenue shown, expenses withheld. Every SaaS has infrastructure costs. A seller who will quote MRR but not hosting, database, and API spend is hiding the margin, which is the number that determines what the business is actually worth. Check: ask for an itemised monthly cost breakdown. Refusal is the answer.
Dashboard screenshots instead of exports. Screenshots are trivially edited. Transaction-level CSVs from Stripe or Paddle are not. Check: request the export. Reconcile the total against the claimed MRR yourself.
Gross revenue quoted, refunds omitted. A product with 20% refunds looks 20% larger than it is. Check: the processor export shows refunds. Net them out.
One-off sales presented as recurring. The multiple for recurring revenue is several times that for one-time sales. Check: categorise the export by whether each charge repeats.
Revenue concentration. One customer above half of revenue means you are buying a contract that can end with an email. Check: sort the export by customer and look at the top five.
User Signals
A signup spike with no traffic to match. Users appearing without a corresponding rise in analytics did not arrive through the front door. Check: overlay signup dates against analytics. The shapes should agree.
Registered users quoted instead of active ones. Registered is a vanity metric; most SaaS has a large dormant tail. Check: ask for monthly active users and the definition of active.
Email patterns. Sequential addresses, one domain, or throwaway providers across a cohort indicate bulk creation. Check: ask for an anonymised signup export — domains and dates, no personal data.
Structural Signals
"I'll keep the domain." The domain carries the brand, the backlinks, and the customer trust. Without it you are buying code.
No source code. Then you cannot maintain, fix or extend anything, and you are dependent on whatever infrastructure it currently runs on.
No analytics history. Any real product has traffic data. Absence means no independent way to corroborate anything else.
Founder-dependent revenue. If customers came through the founder's audience, personal network, or reputation, that channel leaves when they do. Check: ask where the last twenty customers came from, specifically.
Contractor-built code with no assignment agreement. The seller may not own what they are selling. Check: ask who wrote it and whether IP was assigned in writing.
Behavioural Signals
Pressure to close quickly. Legitimate sellers expect diligence. Urgency exists to prevent verification.
Suggesting you move off-platform. This removes the record and the protection simultaneously. It is the standard precursor to a payment scam, and on Escrozon it is flagged automatically.
Vague answers to specific questions. A founder knows their churn rate. Someone reselling a business they bought last month does not.
A price far below market. A product genuinely earning $5,000 a month does not sell for $10,000. Something explains the discount — find out what before you are the one holding it.
The Approach That Protects You
Escrow means time costs you nothing. Funds sit safely while you work through it:
- Twelve months of processor exports and analytics.
- Reconcile revenue against traffic against users — three sources that must tell one story.
- Itemised operating costs, to establish margin.
- Run the application from the source yourself.
- Ask where the last twenty customers came from.
- Confirm code ownership and data-protection posture.
- Confirm receipt only when all of it agrees.
If the numbers do not reconcile, you have documentation rather than a hunch — and documentation is what resolves a dispute.
Testing Revenue Claims
Revenue is the number that sets the price, so it is the number most worth verifying properly.
Ask for the payment processor dashboard, not a spreadsheet. A screen recording moving through the processor's own interface, across date ranges you name, is difficult to fabricate. An exported summary is not evidence of anything.
Reconcile revenue against subscriber count. Monthly revenue divided by active subscribers should produce something close to the advertised pricing. When it does not, the difference is usually discounts, legacy pricing or churn that has not yet shown up in the headline figure.
Ask for gross and net separately. Refunds, chargebacks and failed payments sit between them, and a business quoting gross revenue while carrying a high refund rate is quoting a number nobody ever received.
Look for concentration. If a large share of revenue comes from a handful of customers, the risk profile is completely different from the same revenue spread across many. Ask what proportion the largest customers represent.
Questions That Expose Churn
Churn is the figure sellers are least likely to volunteer and the one that most determines what a subscription business is worth.
- "How many subscribers did you have twelve months ago, and how many of those are still paying?" This is harder to answer misleadingly than a churn percentage.
- "How many new subscribers did you add each month this year?" Flat revenue with high new-customer numbers means heavy churn hidden underneath.
- "What is the average subscription length?" A short average against an annual product implies most people leave at or before renewal.
- "When is the next renewal cluster?" If a large share of annual subscriptions renew shortly after the sale, the buyer is inheriting that risk immediately.
A seller who answers these readily and consistently is describing a real business. One who redirects to growth potential is describing a hope. Verify while the funds are still held, and price the answers rather than the projections.
Frequently Asked Questions
What churn rate is acceptable? For small B2B SaaS, under 5% monthly is healthy and above 7% means the business needs constant new customers just to stand still.
Is a declining SaaS ever worth buying? Yes, if you understand why it is declining and can fix it — and if the price reflects the decline rather than the peak.
How do I verify users without receiving personal data? Ask for aggregate exports: signup dates, email domains, activity buckets. You need the shape, not the identities, and requesting less data is also the correct posture legally.
The seller will not share the processor export. Reasonable? No. They can redact customer names. Refusing the underlying data while claiming a revenue figure is the clearest signal in this list.
What if everything checks out but the price still seems low? Ask directly why they are selling. There is usually an honest answer — burnout, a new project, needing cash. An evasive answer is itself information.
