Most listings for a bad business look exactly like listings for a good one. The screenshot is clean, the story is confident, and the seller is pleasant on every call. What tells you the difference is the pattern behind it: the gap between what is claimed and what the underlying data shows. Independent review sites that track low-end marketplace listings report the same patterns over and over: bot-inflated traffic, edited or reused revenue screenshots, and content resold without the rights to resell it. This guide runs those patterns by category, with the one question that exposes each one.
Numbers flags
The numbers are where most sellers, dishonest or not, get creative first, because numbers are what set the price.
Revenue spike right before the sale. A store flat for a year that suddenly jumps in the final sixty days is not proof of momentum. It is often a discount blitz, stock bought through a second account, or next quarter's sales pulled forward into the window a buyer will price from. Why it matters: you are buying the trend, not the month, and a manufactured spike disappears the day you take over. The one question: can I see the trailing twelve months, week by week, not just the last sixty days.
Claimed profit that ignores ad spend. The quoted profit number somehow survives no matter how much was spent on ads that month. Why it matters: ad spend is usually the largest single cost in an ecom business, and a profit figure that does not move with it was built backward from a number the seller wanted to hit. The one question: what was total ad spend each month, shown against net profit for the same months.
Refund rate hidden. The listing shows revenue and margin but nothing about returns or chargebacks. Why it matters: a high refund rate quietly eats the margin you think you are buying, and sellers who leave it out usually know why. The one question: what was the refund and chargeback rate, month by month, for the last year.
Round numbers that never reconcile. Every figure is tidy, revenue "about 500k", profit "roughly 120k", and none of them add up when checked against each other. Why it matters: real businesses have messy numbers, because real order data is messy. A pitch built entirely from round numbers is a pitch, not a set of books. The one question: can you send the raw export, not the summary, so I can do the arithmetic myself.
Access flags
Numbers on a screen are cheap to produce. Access to the system that produced them is not, which is exactly why access is where sellers who are hiding something start to slow down.
Screenshots offered, read-only access stalled. The seller happily sends another screenshot but keeps finding reasons why read-only access to Shopify or the ad account is a week away. Why it matters: read-only access takes minutes to grant and cannot be edited after the fact, which is precisely why a seller with something to hide prefers screenshots. The one question: can you invite me as a read-only collaborator on the platform directly, today.
"The analytics account is broken." Every explanation for missing data routes back to a conveniently broken tool, a locked-out login, or a platform migration that erased the history right when you asked to see it. Why it matters: one broken tool is plausible. A pattern of broken tools that always happens to cover the exact period you asked about is not a coincidence, it is a stall. The one question: which specific data can you show me right now, even if the rest genuinely takes time to fix.
Rushed timelines. The seller wants an offer this week, citing another buyer, a personal deadline, or a platform deal that expires. Why it matters: diligence takes time on purpose, and a seller pushing you past a proper look at the numbers is asking you to buy on trust instead of proof. The one question: what happens if I decline to move faster than my own diligence allows, said plainly, and watch how the answer changes.
Traffic flags
Traffic numbers are the easiest thing in a listing to inflate and the hardest for a buyer to check without pulling the raw data.
Bot-inflated analytics. Visit counts look strong, but session quality is oddly uniform, bounce rates are unusually low across every channel, and the geography of visitors does not match where the product actually sells. Why it matters: bot traffic pads the top of the funnel to make a store look busier than its order history supports, and a buyer who prices visits instead of orders overpays for a metric that means nothing. The one question: can I see sessions next to orders, by channel, so I can check the conversion math myself.
Traffic that orders do not reflect. The listing claims tens of thousands of monthly visitors, but order volume implies a fraction of that in real buyers, even for a generous estimate of a normal conversion rate. Why it matters: traffic without orders is not an audience, it is a number, and the gap usually means the traffic is not real, not relevant, or not converting for reasons the seller has not disclosed. The one question: what is the actual order count for the same period as the traffic screenshot.
Paid traffic dressed as organic. A channel breakdown labels most visits "organic" or "direct," but the store's ad accounts show heavy, ongoing spend that lines up suspiciously well with the traffic curve. Why it matters: paid traffic is a rented asset that a new owner has to keep paying for, and a store pitched as organically discovered is really a store whose profit partly belongs to an ad platform. The one question: what percentage of traffic is genuinely unpaid, and can that be checked against the ad account directly.
Seller behavior flags
Some red flags never touch a spreadsheet. They show up in how the seller acts, and they are often the earliest and most reliable signal.
Pressure to close outside escrow. The seller prefers a direct wire, a personal payment app, or "a faster way" that skips a neutral third party holding the funds. Why it matters: escrow exists to hold funds until handover actually completes, which protects both sides equally. A seller who resists that protection is asking you to trust them completely with no backstop if the handover goes wrong. There is more on how that protection works in the guide to Kairos security.
Unverifiable identity. The seller's name does not match any business registration, payment processor account, or platform ownership record you can find, and every explanation for the mismatch is a different story. Why it matters: if you cannot confirm who you are actually paying, you have no real recourse if the deal goes wrong after money moves. The one question: can you share the legal entity name and registration behind this business.
Story changes between calls. The founding date, the reason for selling, or the traffic source shifts slightly from one conversation to the next, nothing dramatic, just enough that the details do not stay consistent. Why it matters: a true story does not need to be reconstructed each time it is told. Small inconsistencies are often the first crack in a story built to sound good rather than to be accurate. The one question: asking the same thing two different ways, on two different calls, and comparing the answers.
"Other buyers waiting." You are told repeatedly that other offers are on the table, sometimes at a suspiciously similar price to yours, and that you need to move before someone else does. Why it matters: manufactured scarcity is a pressure tactic, not information, and a genuinely competitive listing does not need to be narrated that way to close. The one question: can I see the actual offer history or timeline, not just the claim that it exists.
Structural flags
The last category has nothing to do with whether the seller is honest. A business can be exactly as described and still be a bad one to buy, because of how it is built.
Single product a competitor can clone. Nearly all of revenue comes from one product with no real brand, patent, or supplier relationship protecting it. Why it matters: a product with no moat can be sourced and undercut by anyone with the same supplier's contact details, and often is, within months of a listing going public. The one question: what stops a competitor from selling the identical product tomorrow.
Single supplier with no agreement. One supplier makes the whole catalog possible, and there is no written agreement covering price, exclusivity, or continuity, just a relationship the current owner has managed informally. Why it matters: that relationship does not transfer with a handshake, and a new owner can find pricing, minimums, or availability change the moment the supplier notices the business changed hands. The one question: is there a signed agreement, and will the supplier confirm the relationship directly to me.
Platform-policy risk. The business depends on one sales channel, one ad account, or one marketplace account in good standing, with no independent website or customer list behind it. Why it matters: a single policy change or suspension can take the revenue line to zero overnight, and no owner can promise that will not happen the week after handover. The one question: what percentage of revenue would survive losing this one channel.
Key-person dependence. The seller personally handles sourcing, a large personal following, or product design, none of it documented or transferable. Why it matters: you are buying what is left after the one person who ran it walks away, often a smaller business than the listing implies. The one question: what does this business look like on day one without the current owner in the room.
What to do with a red flag
One flag is not automatically a dead deal. A store a year old with a single supplier is not lying, it is just early, and plenty of legitimate stores carry real structural risk alongside real upside. What kills a deal is a red flag paired with resistance to checking it: a seller who dodges the one question instead of answering it. A checklist for the full diligence pass walks the order these checks should run in, and a dedicated guide to verifying revenue covers the numbers category in more depth than fits here.
Every listing on Kairos is verified from real order data before a buyer sees it, so the numbers flags above are checked before the listing exists, not left for you to discover after wiring money. For a store on any other marketplace, the paid due diligence service runs the same checks, human-run, on a store you point to, with a report back within five working days. Kairos is pre-launch, so this is the honest state of it: a place built to make these red flags someone else's job to have already checked. For the broader question, see is it safe to buy an online store.