"Legit" usually means three things: the business exists, it's who it says it is, and it has no serious warnings against it. Check each one separately.
Search the official register: Companies House (UK), your state's business register or SEC EDGAR (US), or the GLEIF LEI database for larger international firms. Note the status, incorporation date and registered address.
Impersonators copy real companies. Check that the website, email domain, phone number and address on what you received match the register and the company's official site. A real company name with a different website or bank account is a classic impersonation pattern.
Check regulator alerts (IOSCO I-SCAN collects warnings from many national regulators), sanctions lists (OFAC), and reviews. Be careful with name-only matches: other businesses may share a similar name, and well-known brands are often impersonated, which isn't a mark against them.