Someone Pretended to Be Me: How to Spot Email Scams and Stay Safe
Since early August, my clients have been targeted by email scams from people pretending to be me. Their goal is simple: get you to pay them, or hand over access to your website.
The emails used my name, my phone number, my business address and a signature that looks a lot like mine. Several clients came close to paying before checking with me first, and one called me minutes before sending money. I'm grateful to everyone who forwarded these messages to me. Your caution is exactly what stops these scams.
None of my clients' websites were hacked. The scammers simply collected public email addresses from websites and business directories. But because this kind of impersonation is becoming common, I want to share what these emails looked like and how you can protect yourself from any email scam, whether it claims to come from me, your bank or anyone else.
What the fake emails looked like
Every one of these emails came from a free Gmail address, never from my real address. Each claimed your website needed urgent, paid work before a deadline, usually because of "WordPress requirements."
The fake addresses they used:
- sales.hwdhinc@gmail.com
- sales.hwdshinc@gmail.com
- michele.houstonwebdesign@gmail.com
- michele.houstonweb@gmail.com
The subject lines, and what each one asked for:
- "Action Required: Website Renewals Due by 17 August" (early August)
Asked clients to renew their domain and plugins. - "Urgent: WordPress Compliance & Renewal Required August 12th" (early August)
Claimed an "API renewal" and plugin setup were needed, or the site would be "shut down." - "Important: WordPress Updates Required Before September 2nd" (late August)
Asked for payment to a third party, and for a stranger to be added as an Administrator on the website. - "Website Maintenance Update" (September)
Listed maintenance and license renewals "due" by September 5. - "Important Website CMS, Plugin & SEO Update" (October)
Pushed paid updates before an October 10 deadline. - "Important Website Updates and Your Exclusive SEO Discount" (October)
Sent a detailed $650 "required updates" quote, plus an $850 SEO package with a fake "returning-client discount."
The scammers also adapted as they went. When one client wrote back with questions, the scammer replied with a polished, itemized proposal. When another replied that the work was approved, the scammer followed up asking her to give a new "colleague" full administrator access to the website. That request is the most dangerous of all, because an administrator can take over a site completely.
Red flags to watch for
My clients spotted these email scams using the same warning signs you can use for any suspicious message:
- The sender's address is wrong. Look at the actual email address, not just the name. A real business emails from its own domain, not a free Gmail, Yahoo or Outlook account. The display name can say anything.
- It creates urgency. "Required before September 2nd," "may be flagged or shut down," "Action Required." A firm deadline with a threat attached is the oldest pressure tactic there is.
- It name-drops an authority. These emails claimed a "call from WordPress Support." WordPress is free, open-source software. It doesn't call website owners, set compliance deadlines or shut sites down.
- The greeting is off. "Hi Dear," or a greeting that pastes in your business name in lowercase, is not how someone who knows you writes.
- It asks for money in an unusual way. One message asked a client to pay a company I've never heard of. My invoices only ever come through QuickBooks.
- It asks for access. Any request to add a new administrator, share a password or log in through a link should stop you cold.
- It doesn't match what you already know. One client noticed she'd just received a legitimate notice that her site was fully updated, then a separate email asking for money to update it.
How to stay safe from email scams
The single best defense is to verify through a channel you already trust before you pay, click or share anything.
- Pause before acting on any urgent request. Legitimate providers give you time. Scammers need you to act before you think.
- Contact the person directly. Use a phone number or email address you already have on file, never the one in the suspicious message. A two-minute phone call stopped several of these scams cold.
- Don't click links or open attachments in an email you weren't expecting. If it says your account needs attention, log in the way you normally would instead.
- Never give website or account access by email request. Don't add new users, share passwords or approve login codes for anyone you haven't confirmed by phone.
- Know how your vendors normally bill you. If an invoice arrives in a different format, from a different address or asks you to pay someone new, verify it first.
- Turn on two-factor authentication for your email, website, banking and domain accounts. Even if a password leaks, a second step keeps intruders out.
- Report it. Mark the message as phishing or spam in your email program. You can also report impersonation scams to the FBI's Internet Crime Complaint Center at ic3.gov, the FTC at ReportFraud.ftc.gov, and the BBB Scam Tracker.
- Tell your team. These emails often reach a general inbox (like info@) and get passed around. Make sure whoever handles bills and website requests knows what to look for.
If you already responded or paid
Act quickly, and don't be embarrassed. These emails are designed to fool careful people.
- If you paid: call your bank or card company right away to dispute the charge or stop the transfer.
- If you added a user or shared a password: remove that user, change your passwords and contact us so we can check the site.
- If you clicked a link or entered a login: change that password immediately, and anywhere else you reused it.
- Then report it using the links above, and let the real person or company know they're being impersonated.
How to reach me
If you're my client and anything looks unusual, check with me before you reply, click or pay. Here's how I actually communicate:
- Email: always from michele@michelecaldwell.com. I never use Gmail to email clients.
- Phone or text: 832-316-7830, the number you already have for me.
- Invoices: always through QuickBooks, with the subject "You have a new invoice from Houston Web Design and Hosting, Inc."
- Client announcements: sent through my Mailchimp newsletter.
You can also reach me through my contact page. I'd much rather get a quick "is this you?" text than have you lose money. Thank you to every client who checked first. You're the reason these email scams haven't worked.