12 Red Flags in SaaS Acquisition Due Diligence

EPMV (Earnings Per Mille Visitors) measures revenue per 1,000 sessions. Real SaaS businesses fall between $5–$100 depending on ACV. An EPMV above $100 without evidence of high-ticket enterprise contracts has almost never been observed in real markets — it means the revenue figure, the traffic figure, or both are false.

A business that shows flat or declining revenue for 18 months then a sudden 3x spike in the quarter before it was listed is a textbook pump-and-sell pattern. The spike may be caused by prepaid annual plans sold to friends/family, a promotional push that won't repeat, or outright fabricated invoices.

Real paying customers engage with software — they click, navigate, and return. A business claiming $10K MRR but showing a GA4 engagement rate below 20% means most sessions are bouncing immediately. Legitimate SaaS customers don't bounce. This combination is one of the strongest fraud signals in the ProofCap forensic model.

Organic, editorially earned backlinks have varied anchor text — brand names, URLs, generic descriptions. A backlink profile where more than 60% of anchors are commercial keywords ('best CRM software', 'buy email marketing tool') is a strong indicator of a purchased link scheme — a PBN. Traffic from PBN links collapses post-acquisition when the link scheme is abandoned.

Private Blog Networks (PBNs) are arrays of fake websites built to manufacture backlinks. They're often hosted on the same server subnet — sharing C-class IP ranges (the first three octets). If more than 25% of referring IPs share a C-class prefix, this is a near-certain indicator of an artificial link network.

Every real SaaS business has refunds. Credit card disputes happen. Failed payment retries happen. A 12-month payment export with zero refunds, zero disputes, and zero failed charges is statistically impossible for any product with real customers. The seller has either filtered the export before sharing it or the revenue isn't real.

Organic traffic takes time to build. A domain less than 18 months old claiming $10K+ MRR from organic search is almost always wrong about one of those things — either the domain is older than represented (common with expired domain buys), the traffic is paid (which ends at acquisition), or the revenue is fabricated.

A business where 85% of sessions come from a single acquisition channel — especially direct or a specific referral — is fragile. Direct traffic concentration often means the seller is the primary driver (it stops at acquisition). Single-referral concentration means one partnership or placement is the entire business.

Marketplaces and payment platforms charge meaningful fees. Gumroad takes up to 10%, Paddle takes 5% + processing, Stripe takes 2.9% + $0.30. A seller who consistently cites gross revenue without mentioning these costs is obscuring the real net figure you should be valuing the business on.

AppSumo and similar LTD campaigns create a single revenue spike with zero recurring value. If the seller's 'MRR' is actually an averaged-out LTD campaign from 12 months ago, you're paying a recurring multiple for one-time revenue. The SaaS market premium doesn't apply to LTD-based businesses.

A sophisticated seller can connect you to a higher-revenue Stripe account they own from a different business — especially if they have a portfolio. They claim it's the account for the business you're buying, but the payment method domains or GA4 property doesn't match the URL you're acquiring.

NRR below 90% means the existing customer base is shrinking — expansions from existing customers aren't covering the churn. A business with 85% NRR needs constant new customer acquisition just to stay flat. Presented as 'stable revenue', this masks an underlying decay rate that compounds against you post-acquisition.