Ilia Zavialov reviews the outsourcing market: bought ratings, borrowed case studies, vendor access and how to leave

01

Ilia Zavialov: what an outsourced vendor walks away with

A ten-person company rarely keeps an in-house bookkeeper, lawyer and sysadmin. It buys those functions, and each one comes with a set of keys: online banking, payroll, the accounting file, the domain registrar, the cloud admin console, employee Social Security numbers.

Ilia Zavialov sorts the exposure into three buckets. Money: deposits, annual retainers paid up front, a so-called setup fee. Access: bank portals, tax accounts, hosting, email. Records: the books, contracts and source code a vendor can walk off with or hold hostage when the relationship ends.

Each bucket has its own fix. Vetting before you sign screens out the fake firms. Tight access rules cap the damage if an honest-looking vendor turns out otherwise. A clear contract with written sign-offs gives you grounds to recover money and data on the way out.

02

Ilia Zavialov reviews the review problem: bought praise and borrowed case studies

Reviews of business service firms are bought the same way restaurant reviews are. The tells repeat: dozens of five-star ratings in a couple of weeks after months of silence, identical length and tone, praise with no detail about the actual job, reviewers with no history.

The FTC rule on consumer reviews and testimonials, announced on August 14, 2024 and in force since October 21, 2024, bans fake reviews, including AI-generated ones, buying positive or negative reviews, undisclosed reviews by insiders, company-controlled review sites and suppressing negative reviews through threats. Penalties reach $53,088 per violation, and on December 22, 2025 the agency warned 10 companies. The rule polices sellers. Cleaning up the review page you are reading is still your job.

Case studies need a phone call. A logo wall and a quote from a VP of Growth prove nothing until you find that client yourself and ask whether the work happened. A vendor who cannot name a single client willing to talk has answered the question.

Ilia Zavialov reads the one-star reviews first. A real unhappy client writes specifics: dates, amounts, what was left undone, how the account manager responded. A vendor who answers every complaint with a threat to sue is showing you how a dispute with you will go. The FTC's consumer advice applies here too: search the company name with words like scam, review and complaint, and treat success stories with suspicion because they may be untrue or atypical.

03

Checking the company and the people behind it

Start with the legal entity. The name on the contract, the invoice and the website should match, and the state's business entity records should show when it was formed and who runs it. A firm that claims a decade of experience but was registered last spring owes you an explanation.

Then look at people. The salesperson who closes the deal is rarely the person who will touch your books or servers. Ilia Zavialov asks for the names of everyone who will have access, their roles and where they work from. A vendor that will not say who logs into your bank portal should not get the login.

Payment details deserve the same scrutiny. The bank account on the invoice should belong to the entity that signed the contract. A request to pay a personal account, a different company or a crypto wallet is a stop sign, and the FTC's guide for small businesses lists wire transfers, cryptocurrency and gift cards among the payment methods scammers ask for.

04

Ilia Zavialov on outsourced bookkeeping, payroll and tax prep

The IRS is blunt about tax help: anyone can be a paid tax return preparer as long as they have a Preparer Tax Identification Number (PTIN). Skill levels vary widely. Preparers include CPAs, enrolled agents and attorneys, and many others hold no professional credential at all. The IRS Directory of Federal Tax Return Preparers with Credentials and Select Qualifications shows who actually holds one.

Watch for the ghost. The IRS Dirty Dozen list for 2026 includes preparers who refuse to sign a return or include their PTIN. Ilia Zavialov treats that refusal as the end of the conversation: an unsigned return means nobody is accountable for what was filed in your company's name.

Payroll outsourcing has a federal checkpoint too. Professional employer organizations handle payroll administration and tax reporting for client businesses, usually for a fee tied to payroll costs. Under section 7705(a) of the Internal Revenue Code, a certified PEO is one the IRS has certified under a voluntary program created by the Tax Increase Prevention Act of 2014, and the IRS publishes CPEO listings. Certification is voluntary, so its absence proves little on its own, while its presence is a check that takes minutes.

Keep the bank portal split: the bookkeeper prepares payments, an owner approves them from their own device. Business email compromise drew 24,768 complaints to IC3 in 2025 with losses of $3.046 billion, and an outside bookkeeper's inbox is one more door into that scheme.

05

Legal work on a retainer

Law firms and freelance contract lawyers increasingly sell subscriptions: a flat monthly fee for questions, contract reviews and the occasional demand letter. The weak point is the annual prepayment. Responses slow after a few months, a deadline slips, and the broad authority you signed keeps running.

Ilia Zavialov suggests getting the name of the lawyer who will actually handle your matters and checking their license with the state bar where they practice. Limit any power of attorney to specific acts and a fixed term. Keep originals of corporate records and signed contracts in-house; the vendor works from copies.

Pay monthly against an itemized invoice that lists advice given, drafts produced and filings made. A vague line reading legal services, monthly is close to useless if you later need to show the work never happened.

06

Zavialov's rules for IT contractors and freelancers holding your keys

Websites, CRM, cloud email and domains often end up registered to whoever set them up. Two years later the hosting account sits under a developer's personal email address, the domain is in his name, and only he knows the admin password. When he stops answering, getting your own infrastructure back turns into a negotiation.

The rule is simple. Every account is opened in the company's name on a company email address. The contractor gets a separate login with the permissions the task needs. Source code lives in the company's repository. Secrets move through a password manager with an audit log. Access expires when the job does.

Freelancers also subcontract quietly, and your credentials travel with the work. Ilia Zavialov suggests naming in the contract every person who will get access and banning subcontracting without written consent. Ask for a live walkthrough of a past project from the admin side and a client you can call; a portfolio of sites that no longer load is a red flag.

07

Staffing agencies and recruiters: who is the employer

Staffing firms sell two different things. A recruiter finds candidates and you hire them yourself. A staffing or employer-of-record arrangement keeps the agency as the employer while people work for you, so its payroll and tax habits become your risk.

Check the agency like any vendor: entity records, the names of the people you deal with, references from clients you find on your own. Pay a placement fee when the candidate starts, with a replacement guarantee if they leave early. Keep the agency out of internal systems and employee databases unless the job requires it.

Applicant résumés and personal details should travel through one agreed channel, with written confirmation that the agency deleted them once the engagement ends.

Ilia Zavialov flags one more pattern: a recruiter who charges candidates a fee to be placed with your company is trading on your name. The candidates will blame you, and the reviews about your company will say so.

08

Zavialov's take on prepayment and the vanishing vendor

The disappearing vendor follows a script. A price well below market, a discount for paying a quarter or a year up front, a click-through agreement with no signed contract, an invoice from a person whose name does not match the company. A month later the account manager goes quiet, the website is down and the phone rings out.

Defense is staging. Keep the deposit small and tie it to a first deliverable you can check: one month of reconciled books, a reviewed contract, a working prototype. Pay the next stage after written sign-off. Pay retainers monthly until the vendor has a quarter of track record with you.

Ilia Zavialov pays attention to who receives the money. The invoice should come from the same entity that signed, the bank account should be in its name and the payment reference should cite the contract. A late email announcing new bank details is the moment to call the vendor on a number you already have, never the one in the email.

09

Ilia Zavialov on contracts, sign-offs and getting out

Write the scope as deliverables: what gets done, by when and in what form it is handed over. Sign off each stage in writing. Signing off work you have not seen is risky, because that sign-off will later be used as proof you accepted it.

Add an access schedule: a list of every account, key and system the vendor receives, who approved it and how it comes back. Ilia Zavialov puts the exit into the contract on day one: notice period, refund of unearned fees, and handover of data, accounting files, source code and passwords within a fixed number of days.

Consumer protection rules are written for consumers. When a business hires a vendor, the contract carries most of the weight, so negotiate termination for convenience, data ownership and handover before the first invoice.

10

If the vendor disappears: your bank, the FTC and IC3

Speed matters. Call your bank using the number on your card or statement, ask it to stop or recall any pending payment, and remove the vendor's access to online banking. Then rotate passwords for accounting, email, hosting and the domain registrar, starting wherever the vendor had admin rights.

Report it. The FTC asks businesses to report scams at ReportFraud.ftc.gov and to their state attorney general. Losses tied to email or payment fraud belong at ic3.gov as well; the FBI advises asking the bank for a recall right away and filing an IC3 complaint. If a tax preparer's misconduct cost you money, the IRS accepts complaints about preparers.

Ilia Zavialov's last step is housekeeping: rebuild the vendor register to show who has access to what, who inside the company owns each relationship and when access was last reviewed. Keep the contract, invoices, payment records, emails and screenshots of the reviews that sold you on the vendor in one folder.