A fake email often imitates someone you know, with an address that looks like the real one. Read the full address, don’t reply, write instead to the address you already have, and never click a link that asks you to sign in.
Simon FortinFounder of JustSimpleWeb
An email arrives: your website has an error, you have to pay to fix it.
It carries the name of someone you trust.
A familiar name, a normal request
You know the sender’s name: your supplier, your bank, the person who looks after your website. The message is urgent, but reasonable. There’s even a signature with a photo.
You’re busy. You click, you pay, you move on.
All it takes is an address
Your email address is on your website, on the contact page. So are your suppliers’. Anyone can copy it, then create in two minutes a Gmail address that looks like it.
It happened to me recently. Someone created the address info.justsimpleweb@gmail.com and wrote in my name: the website had an error, I had to pay. My real address is info@justsimpleweb.com. The photo in the signature wasn’t mine. And the payment was requested in euros, when here, everything is invoiced in Canadian dollars.
Fortunately, my customers had been well warned: it all ended well, and not a single person was defrauded.
Nobody is safe, even people who build websites. And it doesn’t only target you: someone can also write to your customers pretending to be you.
The fake delivery person at the door
Someone rings your doorbell in a delivery uniform and asks to come in. You don’t trust the uniform. You call the company, at the number you already have, not the one they give you.
An email is the same. The displayed name is the uniform.
Checking, step by step
1. Read the full address
Not just the displayed name: the whole address, what follows the @. Be wary of a lookalike address, such as a Gmail or Outlook address when the business has its own domain name.
2. Look for what’s off
The usual signature, the photo, the way of writing, the currency, the urgency. A single detail that doesn’t fit is enough to stop.
3. Don’t reply
Write a new email instead, to the address you already have, or call the number you already have. Simply ask: “Did you really write to me?”
4. Never click a link that asks you to sign in
Bank, host, Google, your website’s platform: open the site yourself, by typing its address or using your bookmark, and sign in from there. If there’s really a problem, you’ll see it once you’re signed in.
5. Warn your customers
State your real email address on your website and in your signature, along with how you invoice. One sentence is enough: “Our invoices always come from [your address], in Canadian dollars.” If someone uses your name, warn your customers without waiting.
You can also report the message as phishing in your mailbox, and to the Canadian Anti-Fraud Centre.
A two-minute habit
Reading an address, writing a new email, typing a website’s address yourself: it takes two minutes. And it keeps you from paying someone who never touched your website.
If a step stumps you, we can look at it together.