Over the past several months, a worrying trend has emerged that has affected a number of our clients and contacts.
We posted about this a short while ago here: https://www.lightbulbwebdesign.co.uk/website-design-blog/entry/scammer-alert-fake-email-warning
Individuals have been using publicly available information from our website, including case studies, testimonials and portfolio projects, to identify businesses we have worked with. They then visit those businesses' websites, collect publicly listed contact details, and send unsolicited emails claiming to offer website services, security fixes, SEO improvements or technical support.
In some cases, these messages have even used the names of genuine people associated with our business while being sent from unrelated Gmail addresses or other free email accounts. We have recently received reports from clients who recognised that something didn't seem right and contacted us directly for clarification.
First and Foremost: This Is Not a Data Breach
It is important to be absolutely clear about this.
- No client databases have been accessed.
- No customer information has been stolen from our systems.
- No account, email, website or server associated with our business has been compromised.
The individuals responsible are simply collecting information that is already publicly visible on the internet. They are using our portfolio and case studies as a starting point to identify businesses, and then obtaining contact information from those businesses' own websites, Companies House records, social media profiles or other publicly available sources.
While this activity is misleading and frustrating, it is fundamentally different from a security breach.
How the Scam Typically Works
The pattern tends to be similar:
- The scammer reviews our published portfolio or case studies.
- They visit a client's website.
- They collect publicly available contact details.
- They create a new Gmail or other free email account.
- They send unsolicited emails claiming to have found website issues, security vulnerabilities, SEO problems or compliance concerns.
- They encourage payment outside of established invoicing or support arrangements.
Often the message is designed to create a sense of urgency, mentioning:
- Website security vulnerabilities
- Missing SSL certificates
- SEO issues
- Accessibility problems
- Google ranking concerns
- Website compliance requirements
- "Critical" technical issues that supposedly need immediate attention
In many cases, some of these observations may contain grains of truth because anyone can run automated scanning tools against a public website. The real issue is not whether a recommendation is technically valid, but whether the sender is who they claim to be.
How to Check if an Email Is Genuine
1. Check the Email Address Carefully
The display name means very little.
Scammers frequently use the name of a genuine person while sending from an unrelated email address.
For example:
✅ Genuine:
This email address is being protected from spambots. You need JavaScript enabled to view it. This email address is being protected from spambots. You need JavaScript enabled to view it.
🚩 Suspicious:
This email address is being protected from spambots. You need JavaScript enabled to view it. This email address is being protected from spambots. You need JavaScript enabled to view it. This email address is being protected from spambots. You need JavaScript enabled to view it.
Always look at the actual sending address, not just the name displayed in your inbox.
2. Check How You Usually Receive Invoices
One of the biggest warning signs is a request to pay through an unfamiliar route.
Ask yourself:
- Is this how I normally receive invoices?
- Does this payment request match previous correspondence?
- Is the bank account different?
- Is the invoice system different?
- Have I suddenly been asked to pay via direct transfer when I normally pay through an established platform?
Fraudsters often rely on recipients acting quickly rather than checking established processes.
3. Be Wary of Urgent Security Scares
Messages that claim:
- "Your website has been hacked"
- "You have critical vulnerabilities"
- "Google will remove your website"
- "You must act immediately"
should always be verified independently.
A genuine supplier will generally be happy for you to contact them directly through known channels before taking any action.
4. Contact Your Existing Website Provider
If you receive an unexpected technical report about your website, forward it to your existing website provider.
A genuine provider will usually be able to tell you very quickly whether:
- The issue is real
- The issue is already known
- The issue is exaggerated
- The sender has no connection with your website
Never rely solely on the email itself.
5. Check Previous Correspondence
Before responding, search your inbox.
Ask:
- Have I spoken to this person before?
- Does the email address match earlier conversations?
- Is the writing style familiar?
- Are they using a new email account unexpectedly?
A sudden switch from an established business email address to a free Gmail account should be treated with caution.
6. Verify Through a Known Contact Method
If you are unsure, do not reply directly to the suspicious email.
Instead:
- Call the supplier using a number you already know.
- Use contact information from their official website.
- Reply to an existing verified email chain.
Never rely on contact details supplied within a suspicious message.
Our Advice
Cybercriminals and opportunistic scammers continue to adapt their approach. Rather than attacking systems directly, many now exploit trust and familiarity.
By referencing genuine businesses, real projects and known industry contacts, these emails can appear more convincing than traditional spam.
The good news is that a few simple checks are usually enough to expose them.
If you ever receive an unexpected email claiming to represent our business, especially one offering technical fixes, security services or requesting payment through an unfamiliar process, please contact us directly using the details you already have on file before taking any action.
A quick phone call or email can prevent unnecessary concern and ensure you are dealing with the genuine organisation rather than someone attempting to trade on its reputation.
Have you received one of these emails?
We would appreciate being informed. Every report helps us build a clearer picture of the tactics being used and enables us to warn other businesses within our network.
Email me on
Some examples of recent phishing attempts our clients have reported, with boxes around the items you can easily check: