LinkedIn OSINT: Company Mapping and Employment Checks for Due Diligence

Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.

TL;DR

• For LinkedIn OSINT, remember that LinkedIn is a self-reported source. Company pages, headcounts and job titles are claims, so treat them as leads and test them against registry data.
• Headcount, job listings and the office list on a company page are useful signals about whether a counterparty is real, growing or shrinking, as long as you know how LinkedIn calculates them.
• Google site: queries reach public LinkedIn pages without a login, and the Companies House API lets you check claimed directorships in minutes.
• LinkedIn's User Agreement bans bots and scripted copying, so keep collection manual and proportionate.
• UserSearch pulls corporate, domain and handle checks into one Case with source attribution, so the due diligence file can be checked by the next reviewer.

Why Do LinkedIn Claims Need a Second Source?

LinkedIn OSINT is the use of public LinkedIn company pages, member work histories and job listings as leads in company research, tested against official registers before a team relies on them. A supplier sends over a slick deck. Forty staff, offices in Leeds and Rotterdam, a managing director with twenty years in freight. You open LinkedIn and it all appears to line up: a polished company page, a few dozen people listing the firm as their employer, a steady flow of job adverts. Most onboarding teams stop there.

That is the mistake. Every one of those signals is typed in by a member or a page admin. Nobody at LinkedIn checks that the forty people exist, that the Rotterdam office is more than a virtual address, or that the managing director ever held that role. LinkedIn is an excellent map of what an organisation says about itself. It is a poor record of what is true.

This guide shows how we use LinkedIn for company research in due diligence work: mapping an organisation from its public pages, reading headcount and hiring as signals, and then checking claimed employment and directorships against official registers. The value is in the comparison. When LinkedIn and the register agree, you can move on with confidence. When they disagree, you have found the question worth asking.

What Does LinkedIn OSINT Mean for Company Research?

Open-source intelligence is intelligence produced from publicly available information, collected and analysed for a specific question. The general definition of OSINT covers everything from news archives to satellite images. On LinkedIn, it narrows to three kinds of public material:

• Company pages: the organisation's own description, industry, self-reported size band, website, specialities and listed locations.
• Member pages: the public parts of an individual's work history, as far as their visibility settings allow. For company research, you care about the role and the employer, and very little else.
• Activity: job listings, company posts and public statements by named spokespeople.

The important technical detail is how LinkedIn connects the first two. According to LinkedIn's help page on members associated with a LinkedIn Page, a member appears on a company page when they select that organisation from the list while adding work experience. Page admins cannot add people manually, and LinkedIn says it can take up to 30 days for the associated count to update. In other words, the "employees on LinkedIn" number is a count of members who clicked a name, with a lag of up to a month. It is not a payroll figure.

What Is at Stake in Employment and Company Claims

If you work in compliance, procurement or fraud prevention, false employment claims are not a theoretical problem. In June 2025 the US Department of Justice announced coordinated nationwide actions against North Korean remote IT worker schemes, including searches of 21 suspected "laptop farms" across 14 states. Workers had obtained jobs at more than 100 US companies, and reporting on the case described invented work histories on professional networking sites as part of the approach. Every one of those hires passed some kind of check. The weak point was that the checks relied on claims the applicant controlled.

The UK register is also changing in a way that makes registry comparisons more useful. Companies House confirmed in August 2025 that ID verification for directors and people with significant control would become mandatory from 18 November 2025, with existing directors verifying at their next confirmation statement over a 12-month transition. Verified individuals receive a personal code that links their roles across companies. That makes the officer record a stronger anchor for due diligence than it has ever been, and it gives you a clear question to ask any counterparty whose directors are still unverified late in 2026.

For AML and KYB teams the practical point is simple: a LinkedIn page can support a customer's story, but it should never be the only thing that does. Our AML and compliance workflows are built around that idea of corroboration across independent sources.

Mapping a Company by Hand: Pages, Search Operators and Registers

Here is the manual workflow we teach. It uses a browser, Google and one free API key. Budget 30 to 60 minutes for a small company, longer for a group with several entities.

Read the company page like an analyst

Record which LinkedIn account and settings you used, as part of your method notes. Then open the company page and write down, with the date:

• The self-reported size band (for example "51-200 employees") shown in the About section.
• The associated members count ("X employees on LinkedIn"). Compare it with the band. A company claiming 201-500 staff with nine associated members deserves a question. A company with 300 associated members and a 2-10 band usually just has a lazy page admin.
• The website field. Does the domain match the company's email domain and registry name? This is where domain research starts. Our guide to domain OSINT, WHOIS and infrastructure covers the next step.
• Locations. Company pages can list several offices. Check each address against the registered office and trading addresses in official filings. A "head office" that turns out to be a mail-forwarding service is not proof of anything bad, but it changes the questions you ask.
• Page age and posting history. Scroll the posts. A company claiming ten years of trading whose first post was six weeks ago is worth a note.

If your organisation has Premium Business or Sales Navigator, the Premium Insights panel adds employee count over time, function distribution, notable departures at VP level and above in the last 24 months, and job openings by function. LinkedIn only shows these insights for companies with at least 30 associated members, and it is explicit that the figures derive from member-provided data. A sudden fall in headcount alongside a spike in finance hiring tells a story. Write the story down as a hypothesis, not a finding.

Treat job listings as signals, not facts

Job adverts are some of the most honest content a company publishes, because they are written to attract real applicants. Read them for the tech stack, the reporting lines, the office locations and the products named. Then check three things:

1. Consistency. Do the adverts match the company's stated business? A "logistics software provider" hiring only crypto trading staff is a mismatch worth recording.
2. Repetition. The same role reposted every fortnight for six months can mean high turnover, an evergreen advert or a listing that exists to look busy.
3. Verification. LinkedIn's verification badge on job posts means the company has a verified page and the poster has verified that they work there. LinkedIn also says the absence of a badge does not indicate a problem. Use it as one input.

Google operators that reach public LinkedIn pages

LinkedIn's own search is login-gated and personalised. Google is neither, and it indexes the public versions of many company pages, member pages and job listings. Google's help page on refining web searches documents the operators below.

site:linkedin.com/company "Marrowgate Haulage"

site: limits results to one site or path. Adding /company restricts results to company pages, which helps when the name is common. The quotes force an exact phrase match.

site:linkedin.com/in "Marrowgate Haulage" "managing director"

This finds public member pages that mention both the company and the role. Expect false positives: former staff, people at similarly named firms, and snippets that Google cached months ago. The snippet shows what the page said when Google last crawled it, not what it says today.

site:linkedin.com/jobs "Marrowgate Haulage" -intern

Pulls indexed job listings and uses - to drop intern roles. Job URLs expire quickly, so capture what you find.

"Marrowgate Haulage" "Rotterdam" site:linkedin.com after:2025-01-01

after: (and before:) narrow results by date. Google applies these loosely to its own idea of the page date, so use them to thin results, not to prove when something was posted.

"example.com" site:linkedin.com/company

Searching the company's domain finds pages whose website field or description mentions it. This is a quick way to find a second, older company page that someone forgot to delete.

Friction to expect: Google often shows a member's name and headline but LinkedIn demands a login when you click through. Regional subdomains (such as uk.linkedin.com) appear in results, and site:linkedin.com covers them. Do not script these queries. Google rate-limits automated searching quickly and it is outside both Google's and LinkedIn's terms.

Check claimed directorships against Companies House

Now test the claims. For a UK company, the Companies House public data API gives you officer lists and each officer's appointment history. It is free, but it needs an API key: the authorisation guide explains that you register an application and send the key using HTTP Basic authentication, with the key as the username and nothing after the colon. The documented rate limit is 600 requests per five minutes; go over it and you get HTTP 429 until the window resets.

curl -s -u YOUR_API_KEY: \
  "https://api.company-information.service.gov.uk/search/officers?q=Jane+Example"

-u YOUR_API_KEY: sends the key as the Basic auth username (the trailing colon matters: it tells curl there is nothing else to send). /search/officers returns officers whose names match, each with a link to their appointments. Common names return dozens of matches, so narrow them using the details the register shows, such as other appointments and the company name, before you go further.

curl -s -u YOUR_API_KEY: \
  "https://api.company-information.service.gov.uk/company/01234567/officers" | jq '.items[] | {name, officer_role, appointed_on, resigned_on}'

Lists current and past officers for one company number, with roles and dates. jq (install it from your package manager) trims the JSON to the fields you need. Compare appointed_on with the start date the person gives on LinkedIn. A "founder and director since 2015" whose appointment began in 2024 is a conversation, not necessarily a lie: people often describe informal roles loosely.

Outside the UK, OpenCorporates aggregates company and officer records from more than 140 jurisdictions. Coverage and freshness vary by registry, so always click through to the primary source before you rely on a record.

Use LinkedIn's own verification signals carefully

LinkedIn now offers workplace verification with a work email: the member receives a code at their company address and a badge appears next to their name. Viewers see the badge, not the email. It is a meaningful signal, because it shows the person controlled a mailbox on the company's domain at some point. It is not available at every company yet, and it says nothing about seniority or dates. Absence of a badge tells you almost nothing.

Where Does the Manual Method Start to Break?

The workflow above works for one company on a quiet afternoon. It breaks when you have fifteen suppliers to onboard this week. Search snippets go stale between reviewers. Screenshots end up in someone's downloads folder with no timestamp. One analyst checks the registry, another checks the domain, and nobody writes down which sources they used.

This is where we built UserSearch to help. In the UserSearch 2.0 platform, the Corporate Intelligence and Domain Intelligence Search types sit alongside Username Intelligence, so the company, its website and the handles it uses on other platforms can be checked in one place. Our guide to username OSINT for organisations covers confirming a company's official accounts. OneScan runs one input across the data sources you select and merges the results with source attribution, and it shows you the Credit cost before you run it. You get access to 100+ third-party data sources through one UserSearch account instead of managing a separate subscription for each provider.

The audit trail matters as much as the searching. Run the work in a Case with Forensic Mode on and your search history and bookmarks are stored with it, so a reviewer can see what was checked. Teams can share Cases and draw on a common Credit pool controlled by the team leader. When you need to preserve a LinkedIn company page exactly as it looked, our free Forensic Capture browser extension captures the full page with SHA-256 fingerprints and two independent timestamps, and it runs locally in your browser. Everything UserSearch returns is a lead to corroborate. Coverage and freshness depend on the third-party source.

Four Due Diligence Patterns That Use LinkedIn Well

Supplier onboarding: does the team exist?

Context. A procurement team at a fictional retailer is onboarding Marrowgate Haulage Ltd, which claims 45 staff and offices in Leeds and Rotterdam, with its website at example.com.

Actions. The analyst records the company page: a 51-200 size band, 11 associated members, two listed locations. A site:linkedin.com/company "example.com" query finds a second, dormant page under a slightly different name. The Companies House API shows the company was incorporated 14 months ago with two directors. Domain research shows example.com was registered three weeks before incorporation. The Rotterdam address in the Locations list matches a serviced office provider.

Outcome. Nothing here proves wrongdoing. It does show the company is younger and smaller than the deck implies. Procurement asks for accounts, a client reference and the Dutch registration, and records the findings in the Case with captures of both LinkedIn pages. The supplier is onboarded with a lower initial credit limit.

Checking a claimed director before signing

Context. A fictional investment firm is about to sign a term sheet with Example Analytics Ltd. The CEO's LinkedIn member page lists three earlier directorships at "successful exits".

Actions. The analyst searches the officer index by name, narrows the matches using the details the register shows and the company names on the LinkedIn page, and pulls the appointments list. Two of the three companies appear, both dissolved within two years via voluntary strike-off. The third was never a UK company; OpenCorporates shows a record in another jurisdiction, and the analyst follows it to that registry. Consistent register details across each appointment support the view that the records describe one officer.

Outcome. The "exits" were closures. That is a fair business history, but it contradicts the pitch. The deal team raises it directly, gets a candid explanation and adjusts the valuation. The discrepancy table (claim, source, registry record, date checked) goes into the file.

Spotting recruitment lures that borrow your brand

Security teams increasingly find job listings and recruiter accounts that use their company's name to approach candidates, sometimes as a route to deliver malicious "coding tests". Search for your own company name across site:linkedin.com/jobs and site:linkedin.com/company on a schedule that suits your risk, and compare what you find with the roles HR actually has open. Listings without the verification badge, recruiters with no associated history at your company and pages with your logo but a different website field go on the list. Report them to LinkedIn and warn candidates through your careers page.

Reading a hiring trend in a counterparty

For investment or credit decisions, the direction matters more than the level. Record the associated member count and open job listings on the same day each quarter. Pair it with filed accounts and news. A company announcing expansion while associated members fall and senior finance staff leave is showing you something the press release does not.

Staying Within LinkedIn's Terms and Data Protection Law

LinkedIn's User Agreement (the version effective 3 November 2025) is direct about automation. Its list of prohibited conduct includes using bots or unauthorised automated methods to access the service, and using software, scripts, crawlers or browser add-ons to copy member pages and other data. It also restricts copying or distributing information obtained from LinkedIn without the content owner's consent. The practical rule for your team: read pages manually, capture what you need as evidence, and do not run collection tools against LinkedIn.

LinkedIn enforces this. It sued Proxycurl, a company that sold LinkedIn data through an API, in January 2025, alleging large numbers of inauthentic accounts and automated requests. The company shut down on 4 July 2025, with its founder writing that there was "no winning in fighting this". If a vendor offers you bulk LinkedIn data, ask where it came from.

Data protection law applies too. A member page is personal data even when it is public. Under the UK GDPR and EU GDPR you need a lawful basis (for due diligence this is usually legitimate interests, backed by a short written assessment), and you should collect only what answers the question. In practice:

• Record the purpose of the check before you start, and keep to it.
• Collect role, employer and dates. Leave out personal posts, family details and anything unrelated to the business question.
• Research companies and the officers who act for them, not private lives. Once the question is answered, stop.
• When you contact people, do it openly under your real name and organisation.
• Set a retention period for captures and delete them when the file closes.

Frequently Asked Questions About LinkedIn OSINT

What is LinkedIn OSINT?

LinkedIn OSINT is open-source research using the public parts of LinkedIn: company pages with their description, size band, website and locations; the public work history on member pages, limited to role and employer; and activity such as job listings and company posts. Because LinkedIn content is self-reported, LinkedIn OSINT produces leads that must be tested against official registers.

Is the employee count on a LinkedIn company page accurate?

The employees on LinkedIn figure counts members who selected that organisation while adding work experience, not staff on a payroll. Page admins cannot add people manually, and LinkedIn says the count can take up to 30 days to update. The size band in the About section is self-reported by the page admin, so compare both figures with filed accounts.

Can LinkedIn show whether a company is growing or shrinking?

LinkedIn can suggest a direction, not prove it. Record the associated member count and open job listings on the same day each quarter, and pair them with filed accounts and news. Premium Insights adds employee count over time for companies with at least 30 associated members, but LinkedIn says these figures derive from member-provided data.

How do you verify a director's claims from LinkedIn?

To verify a director's LinkedIn claims in the UK, use the Companies House public data API, which is free but needs an API key. Search the officer index by name, narrow the matches using the details the register shows, and compare appointment dates with the dates on the LinkedIn page. Outside the UK, OpenCorporates points to records from more than 140 jurisdictions.

Is LinkedIn OSINT allowed under LinkedIn's terms?

LinkedIn's User Agreement prohibits bots, unauthorised automated access and software or scripts that copy member pages, so LinkedIn OSINT should stay manual and proportionate. Member pages are also personal data under the UK GDPR and EU GDPR, so due diligence teams need a lawful basis, usually legitimate interests, and should collect only role, employer and dates.

What Google search operators work for LinkedIn research?

Google indexes many public LinkedIn pages, so site:linkedin.com/company with a company name in quotes finds company pages, site:linkedin.com/in with a company and role finds public member pages, and site:linkedin.com/jobs finds indexed job listings. Snippets show what a page said when Google last crawled it, and these queries should be run by hand, not scripted.

Turning LinkedIn Signals into Evidence Your Reviewers Can Check

LinkedIn is the fastest way to see how a company presents itself: who says they work there, what it is hiring for and where it claims to operate. It becomes due diligence only when you test those claims against sources the company does not control, such as the register, filed accounts and domain records, and when you record what you found in a form someone else can check. If you are new to this kind of work, our OSINT fundamentals knowledge base is a good place to set up your method.

Stop guessing. Start researching with UserSearch. One account gives your team 18 Search types and access to 100+ third-party data sources, from Corporate Intelligence to Domain Intelligence. OneScan merges results with source attribution, Cases in Forensic Mode keep the search history your reviewers need, and SargeBot can help you build entity searches and draft a PDF report that you verify before it goes on file. Start your next company check with UserSearch.