Always, always, always, call the auditor who prepared the statements to determine whether you have real statements. We just did this on our "Invisible Children" post ... and they were delighted to talk to us! (P.S. They said good things about Invisible Children)
Also check with the State Board of Accountancy look-up to see if they really have a license. It's easy.
We've found auditors who had expired licenses or were not licensed to present audit opinions. I even found a case where the "client" stole CPA letterhead and published his own audit!
This is the perfect example of a complete fake. This SEC press release shows that James Michael Murray invented a fake CPA Firm, with a noble name, Jones, Moore & Associates (JMA). He invented fake CPA's, and published faked statements. I really wonder how the SEC figured this one out.