Picture this. You get a text from a client. "Hey, did you send me an email about updating my website?"
You didn't send anything.
That's exactly what happened to a web designer whose clients were targeted by a sophisticated scam. Someone created a fake email address designed to look like hers. They found their clients by searching the internet. Then they sent those clients professional-looking emails, pretending to be her, offering website services. The payment link would have stolen credit card numbers and installed malware on their computers.
Stage One: The Friendly Email
The first email arrived looking completely normal. It was signed with the web designer's real name, real photo, and real business name. It referenced past work together. It offered a friendly website refresh with better design, stronger SEO, and updated content.
The tone was warm. Professional. Like it came from someone the client already knew.
The fake email address looked like this:
dottypremiumwebsites.net@gmail.com
See the trick? I am showing you how someone can take my real name, add my domain, and slap it on @gmail.com. On a phone screen, where the full address often gets cut off, it can look perfectly legitimate. Slow down and read the whole thing, and the Gmail part gives it away immediately. This can happen with any domain.
That first email did not ask for money. It just started a conversation. That's what made it so effective.
Stage Two: The Fake Website Audit
When a client wrote back, the scammer sent a follow-up email. It included a screenshot of that client's actual website. It showed a performance score. It listed specific problems found.
This is a trust move. Seeing your own website in an email makes you think, "They clearly looked at my site. This must be real." It feels personal. It feels researched.
None of it was real. The audit was fabricated. The performance scores were fake screenshots designed to look credible.
Stage Three: The Pricing Email and Payment Link
After the fake audit, a pricing email followed. Two packages were offered, with a 10% "returning client discount" applied to both. That detail is clever. It mimics the way a real, relationship-based business would treat a loyal client. It felt familiar. It felt earned.
The payment link went to a Shopify-style store selling something called "Website Enhancement." The store had zero branding connected to the actual web designer. No logo. No business name. Nothing. That was a mistake on the scammer's part. A client paying close attention would notice the mismatch immediately.
Had anyone completed the purchase, the scammer would have walked away with their credit card details. And the "instant download" attached to the product? Almost certainly malware.
This Could Happen to Your Business, Too
This is the part I really want you to sit with.
You don't have to be a web designer. You don't have to be a big business. If you have a website, a client list, and a name people recognize, you can be impersonated.
Here is how simple it is for a scammer to do this:
They find your business name and website online
They create a Gmail address using your name or business name
They search for your clients through your testimonials, portfolio, social media tags, or any public mention
They email those clients pretending to be you, offering services your clients would expect from you
The scammer likely created a specific fake email address for this particular business. If they are running this at scale, and experienced scammers usually are, they are doing the same thing for dozens of businesses at a time. One fake address per target. Each one looks legitimate at first glance.
Your clients trust you. They have a history with you. They want to believe your email is real. That trust is exactly what the scammer exploits.
The Part That Should Concern You Most
After discovering the scam, the web designer sent an alert to all of her clients. She included a screenshot of the fake email and asked who had received it.
What came back was eye-opening.
Many clients said yes, they had received the same email. Most deleted it and moved on. A few replied to the first email, then recognized something was off when the fake audit arrived. Only one client reached out to the designer at the time.
Only one.
What to Do Right Now
Whether you are a solopreneur worried about being impersonated or a client learning to spot fakes, the steps are the same. And none of them require being techy.
If You Run a Service Business
Email your clients now and let them know scammers may try to impersonate you. Do not wait for it to happen first.
Tell them your real email domain and that you will never ask for payment through a random link in an email.
Set up a free Google Alert for your business name at google.com/alerts. You will be notified whenever your name appears somewhere new online.
Add a short note to your website with your official contact information and email address.
If You Are a Client or Small Business Owner
Read the full email address, not just the display name. A Gmail address from an established business is a red flag worth pausing on.
Never pay through a link in an unexpected email. Go directly to the business website instead.
Do not open downloads from emails you were not expecting, even if the sender looks familiar.
When something feels off, say something. A quick message to your actual contact takes 30 seconds and could save everyone a lot of trouble.
Report suspicious emails to the FTC at reportfraud.ftc.gov.
About the Author
Dotty Scott, owner of Premium Websites, Inc. and AskDotty.com, is a website designer, business owner, and educator for digital marketing. She enjoys empowering other business owners to take control of the technology used in their business. She teaches online techniques in an easy to understand language. Dotty also loves photography, hiking, camping, and family time.
At AskDotty, no question is a dumb question, especially when it comes to protecting your business online. If you want to learn more about staying safe and visible as a solopreneur, come hang out with us.
We're advancing awareness and access for holistic health and wellness. Your contributions help us continue in our mission to connect consumers with wellness providers and build a supportive community for both holistic professionals and wellness seekers.
Give a gift today!