You can use the BATFE's "FFL eZCheck" site to verify if an FFL is legit and that you're shipping to their address (and not to the address on a forged FFL). Have the FFL provide you with the first three digits and the last 5 digits of their FFL number. Use this on the FFL eZcheck web site to verify that the FFL is valid (expiration date) and that the shipping address on the web site matches the address they want you to ship to. Note that, while some FFLs do receive product at their mailing address, I suggest ONLY shipping to the PREMISE address identified by the FFL eZCheck web site.
Also, if someone provides you with a paper or electronic copy of an FFL and asks you to ship to the, always use the FFL eZCheck web site to verify that someone didn't obtain a copy of an FFL, then modify the address on the copy. Again, the FFL eZCheck site will verify EXACTLY what should be on that paper or electronic FFL copy. If ANYTHING is different, it's most likely a forgery.
Finally, if you are a non-licensee and are planning on shipping directly to an FFL, make sure that (a) the FFL will
accept a shipment from non-licensee and (b) you use the appropriate and legal means to ship (e.g., you can't ship a handgun via USPS nor pack/print/ship by handing it to the UPS guy or dropping it off at a UPS retail store).
BATFE's FFL eZCheck site:
https://fflezcheck.atf.gov/FFLEzCheck/