The Indian software services market has thousands of genuine firms and a meaningful number whose websites are considerably more impressive than their capabilities. Photographs of a leadership team who do not exist, client logos never worked with, certifications never held, and case studies describing projects that did not happen — all of it is easy to produce and none of it is verified by anyone. Before paying a deposit to a firm you found online, four checks are worth twenty minutes.
First, confirm the legal entity. Every Indian company has a Corporate Identity Number registered with the Ministry of Corporate Affairs, and the MCA portal will tell you the registered name, incorporation date, registered address and the directors. Compare that with what the website claims. A firm claiming fifteen years of experience with an incorporation date three years ago is telling you something. A firm whose trading name does not correspond to any registered entity is telling you more.
Second, check the people. Look up the named leadership on LinkedIn and see whether the profiles predate the website, have a history, and have connections consistent with the claimed career. Invented leadership profiles typically have no history, few connections, and a photograph that reverse-image-searches to a stock library — which takes thirty seconds to check and is the single most reliable test available.
Third, verify certifications rather than accepting the badge. ISO certificates carry a number and an issuing body, and accredited certification bodies maintain searchable registers. A firm displaying ISO 27001 should be able to send you the certificate with its scope statement, and the scope matters — a certificate covering one office and not the delivery team is technically true and practically meaningless. SOC 2 is a report, not a badge, and a firm claiming it should be willing to share it under an NDA.
Fourth, speak to a client they did not choose. Any firm can produce a friendly reference. Ask instead for a client in your industry, ask for one whose project went badly, and ask on the call what went wrong and how it was handled. Firms that have done real work answer that comfortably. You can also check independently: search the firm's name alongside words like dispute or refund, look at Google reviews with attention to whether they arrived in a cluster, and check whether their claimed clients mention them anywhere.
Then structure the engagement so that being wrong is survivable. Never pay a large advance. Start with a small paid piece of work — a discovery phase, a first module — with a defined output you could hand to a different firm. Insist that the repository, cloud accounts and domain are provisioned in your name from day one. A capable firm agrees to all of this without hesitation, because it costs them nothing. Resistance to any of it is the most useful signal in the entire process.
