A fake software development company in 2026 rarely looks fake. Anyone can now put up a polished website in an afternoon, generate a confident proposal with AI, and fill a portfolio page with screenshots of products they never touched. The obvious warning signs, like typos, no address, or a free email domain, have mostly disappeared. What is left are subtler signals, and they only show up once you know where to look and which questions to ask.
We are an agency, so take this with that in mind: we have an interest in clients choosing agencies carefully. But we also inherit a steady stream of projects from vendors who were not what they claimed to be, and the patterns repeat. This guide covers the red flags we see most, and, more usefully, how to verify an agency's claims before you sign. If you are still at the stage of comparing honest agencies against each other, our guide on how to choose a software development agency covers that side of the decision.
What a fake software development agency actually looks like in 2026
"Fake" rarely means a pure scam that takes a deposit and vanishes. That happens, but it is the minority. More often it means one of these:
- A reseller posing as a builder. A sales front that takes your project and passes it to the cheapest subcontractor it can find, with no technical oversight in between.
- A template shop selling "custom" work. The product you pay a custom price for is a purchased theme or white-label script with your logo on it.
- A trend chaser. A team that relabelled itself an "AI development company" last quarter, with nothing shipped in that space.
- An agency that can build but cannot run a project. Real developers, but no discovery, no QA, no documentation, and no plan for what happens after launch.
All four will produce something you can click on. The damage shows up later: when you try to add a feature, change vendors, pass a security review, or raise money and an investor's technical advisor opens the repository.
Red flags that a software development company is not what it claims
"Custom" that is really a reskinned template
Templates are not the problem. A theme or an off-the-shelf platform is often the right call, and a good agency will tell you so. The problem is being charged for custom development and receiving a reskinned marketplace script. Signs include a quote that arrives within hours for a complex product, a demo that already has features you never mentioned, and admin panels with another product's name in page titles or code comments. Ask directly: "Which parts of this are built from scratch, and which come from a template, library, or licensed script?" An honest vendor answers that easily.
No verifiable portfolio or live URLs
Screenshots prove nothing. Every case study should name a product you can find, and ideally link to something live. Some work is genuinely confidential, and several of our own projects are internal or enterprise systems with no public URL. That is normal. What is not normal is a portfolio where nothing can be verified at all. Where we can, we link the live product: the steel fabrication configurator and FleetReact both have working demos you can open yourself.
A vague process with no discovery or QA phase
Ask the agency to walk you through what happens between signing and the first release. If the answer is "we start coding immediately," be careful. Real software projects have a discovery or scoping phase, written acceptance criteria, a QA step that is someone's actual job, and a staging environment you can test on before anything reaches users. An agency that cannot describe its process in specific steps usually does not have one.
Newly claimed expertise with no shipped work
Every hype cycle produces a wave of agencies that suddenly specialise in it. If a vendor claims AI, blockchain, or any other hot capability, ask to see one shipped product in that area and to speak to the engineer who built it. "We have done several, but they are under NDA" is acceptable once. It is not acceptable for every single claim.
Weak security practices
Listen to how the agency talks about credentials and data. Red flags include asking for your production passwords over chat, wanting to host your product on their own account "for simplicity," having no answer about backups, and treating authentication as something they will "add later." Competent teams talk about rate limiting, input sanitisation, secrets management, and least-privilege access without being prompted, because those things are in every project they ship.
Outdated or unexplained technology choices
Older technology is not automatically wrong, but you should hear a reason. If an agency proposes a framework version that is out of support, or a stack only they seem to use, ask why. The real answer is often "it is what our one developer knows," which means hiring anyone else to maintain your product later will be difficult.
No code ownership or IP clause
Read the contract for three things: who owns the source code, when ownership transfers (it should be on payment, not on "project completion" as defined by the vendor), and what third-party licences are included. A missing IP clause is one of the most expensive red flags because you only discover it when you try to leave.
Fixed price with no defined scope
A fixed price is only meaningful against a fixed scope. A vendor who quotes a firm number for a one-paragraph brief has either padded the price heavily, plans to cut corners, or plans to recover the difference through change requests. A written scope, even a short one, is what makes a fixed price honest.
Refusing repository access
You should be able to see your code from the first week, in a repository you own or will own, with real commit history. "We will hand over the code at the end" is the single clearest warning sign on this list. It means you cannot check progress, cannot get a second opinion, and cannot leave without starting again.
How to verify a software development agency before you sign
Red flags help you filter. Verification is how you decide. These checks take a few hours and are worth far more than another round of sales calls.
- Open the live URLs. For every case study that claims a live product, open it. Check that it works, that the features described actually exist, and that the product looks maintained.
- Ask for a code walkthrough. Ask an engineer, not a salesperson, to share their screen and walk through a codebase they built: folder structure, how authentication works, how they deploy, how they test. If client code is confidential, an internal tool or a sanitised module is fine. What you are testing is whether the people you will work with can explain their own work.
- Talk to references you choose. Ask for two or three past clients, then ask those clients what went wrong and how the agency handled it. Every project has problems; you want to hear how they were resolved.
- Check that names and claims line up. Do the engineers on the proposal have real professional histories? Does the company registration match the name on the contract? Do the dates on case studies make sense?
- Get a technical second opinion. If you are not technical, pay an independent developer for an hour to review the proposal and ask a few questions. It is a small cost compared with the build.
Why a paid discovery phase is the best fraud filter
The most reliable test we know is a short paid discovery engagement before the main build: one to a few weeks where the agency produces a written scope, an architecture outline, wireframes or a clickable prototype, and a revised estimate. You pay for real work and you keep the output, whether or not you continue.
This filters out fake agencies better than any checklist, because the output shows exactly how they think. A template shop cannot produce an architecture document for a product it has not thought about. A reseller struggles to produce detailed technical decisions. And an honest agency benefits too, because the main estimate is based on real understanding rather than guesswork. If a vendor refuses any paid discovery and insists on a large fixed-price contract from a short call, treat that as information.
The best test of an agency is a small piece of real work you own afterwards, not a bigger sales deck.
What a legitimate agency should give you without being asked
The positive version of the list above is short. A legitimate partner should, as a matter of course:
- Give you access to the repository, project board, and staging environment from the start.
- Put the cloud accounts, domains, and third-party services in your name, with their team invited as users.
- Explain technology choices in terms of your product, your budget, and your future hiring.
- Tell you when something should not be custom-built, including when an off-the-shelf tool is the better fit.
- Write down what is in scope, what is not, and how changes are priced.
- Show shipped, verifiable work in the area they are pitching. For example, if we pitch an AI integration we can point to products like DataCorpGroup AI and explain how it was built.
None of this is unusual. It is simply what custom web development done properly looks like, and good agencies are relieved when clients ask for it.
Frequently Asked Questions
How can I tell if a software agency's portfolio is real?
Open every live URL, check that the features described actually exist, and ask the agency to connect you with the client behind at least one project. For confidential work, ask for a screen-share walkthrough with the engineer who built it. A portfolio where nothing can be verified in any way is a red flag.
Is it normal for an agency to keep the source code until the project ends?
No. You should have repository access from the first week, and the contract should state that code ownership transfers to you on payment. Withholding code until the end removes your ability to check progress or change vendors.
Are fixed-price software contracts a red flag?
Not by themselves. A fixed price is reasonable when it is tied to a written scope with clear acceptance criteria. It becomes a red flag when a vendor quotes a firm number for a vague brief, because the price has to be recovered somewhere, usually in quality or change requests.
What should I do if I think I have already hired a fake development company?
Secure access first: make sure repositories, hosting, domains, and app store accounts are in your name. Then get an independent code review to understand what you actually have before deciding whether to continue, rescue, or rebuild.
If you want a second opinion on a proposal, or an independent look at a codebase you have already paid for, get in touch with our team. We will tell you honestly what we see, even if the answer is that your current vendor is doing fine.