One thing that I have begun to do is to search the potential client's address using Google Maps at the street level. Most often the foreign company is using an address that turns out to be a UPS store or a small building with a suite number that implies it is in a much larger building such as Suite 5095 in a smallish building that has at most 2 floors that might be located in an office park.

When I find this to be the case, I inform the potential client that I do not accept clients with a business address that is actually a PO Box instead of a physical one.   

It is a shame that it has come to the point that we have to perform due diligence on all new client requests to ensure that we are not dealing with a shell company created by a foreign entity for the sole purpose of acquiring information that isn't available online.