On September 24, I found out about an email that had landed in a client's general sales inbox. It looked like it came from me. It had our name on it, my real photo, and a subject line about website renewals and maintenance. It didn't come from me.
Here's the short version. This year, scammers have been emailing small businesses from look-alike Gmail accounts that use the name of the business's web designer. The emails say renewals or WordPress maintenance are due, and they ask for payment. If you get one, don't reply and don't pay. Check with your web person using contact details you already have. For us, those details are in our security notice.
What landed in a client's inbox
The email came from a free Gmail account built from our business name. The subject line was "Upcoming Website Renewals and Maintenance Review." It told my client that WordPress theme and plugin updates were due and asked for a small "renewal" payment.
It looked the part. It used my real headshot, so anyone who's met me would recognize the face.
When I saw it, the problem was obvious. That client's site isn't WordPress. It's a site we built on our own custom system, so there are no WordPress themes or plugins to update, and nothing to renew.
What the email gave away
Once you know what to look for, the email is almost clumsy. But at a glance, on a phone, between customers, it could work. Here's what gave it away.
The sender was a Gmail address built from our name. It looks official if you only see the display name, which is all a lot of phones show. We don't send business email from Gmail.
The signature didn't match the sender. It listed a different look-alike Gmail address, so the email couldn't even agree with itself about who sent it.
Our domain was misspelled. The signature used our name with the "s" dropped from the domain. It's easy to miss, which is the point.
The technical claim didn't fit the site. WordPress updates for a site that doesn't run WordPress is a guess, and this one guessed wrong.
Put together, it looks like a template that gets reused from one agency to the next with the names swapped in. We aren't the only ones seeing it. Agencies in Australia, the UK and the US have posted near-identical warnings this year, and at least one of them listed the exact same subject line.
It's still happening, and it's getting worse
After I saw those warnings, I reached out to some of the agencies that had posted them. I wanted to know whether this was a one-time wave or something still going on.
One designer who'd been hit wrote back. By that designer's account, it's getting worse, not better, and some of their clients did pay.
That designer also thinks real people are doing this by hand rather than bots. The scammers emailed one of their clients at an address that was listed only on that client's Facebook page. That takes someone actually looking.
The scammers also asked for payment through PayPal's friends and family option. That matters. PayPal says personal payments to friends and family aren't covered by its Purchase Protection, which is what can help a buyer when a payment for goods or services goes wrong. A real business billing you for work has no reason to ask you to pay it like a gift to a friend.
Why scammers go after web designers' clients
A web designer's portfolio is a public page that says, in effect, "I built this business's website." Your own site probably lists a contact email. Put those two things together and a scammer knows who you hired and how to reach you.
Other designers who've been hit describe the same thing, with portfolios and "built by" footer credits used as target lists. In our case, the likely source is our public portfolio plus the client's public contact email, not a break-in. More on that below.
The trust is already there. You've paid your web person before, so an email from them about renewals feels normal. That borrowed trust is the whole trick.
Renewals and maintenance are believable. Domains, hosting and updates really do renew, and most owners don't know the exact dates or even what platform their site runs on. The scam counts on that, which is also why the WordPress guess gave this one away.
It's cheap to repeat. A few free Gmail accounts and one template can be pointed at agency after agency. And if the Facebook detail is any sign, the people running it are willing to dig through public pages to find the right inbox.
This isn't new: a short history of fake renewal notices
The con itself is old. What's changed is whose name it borrows.
In 2003, the FTC said a company called Domain Registry of America had mailed millions of notices that looked like renewal notices or invoices from people's current registrar. A registrar is the company where your domain is registered and renewed. Paying one of those notices didn't renew anything. It moved the domain to a different registrar.
A December 2003 court order barred those misrepresentations and required refunds for people who cancelled a pending transfer. The company settled without admitting it broke the law.
A few years later, the FTC said a Toronto-based operation called Internet Listing Service had been sending small businesses and nonprofits fake invoices since 2004 for an annual "WEBSITE ADDRESS LISTING." The invoices looked like they came from the recipient's existing registrar and listed their real domain or a slight variation of it. A court halted the scheme in 2008. Orders in 2010 barred the defendants from claiming a preexisting business relationship or that people owed them money.
In 2014, ICANN, the nonprofit that coordinates domain names, stepped in on the registrar side. It sent a breach notice to the registrar behind the Domain Registry of America mailings, citing resellers' "false advertising, deceptive practices, or deceptive notices" and noting complaints "since at least 2009." It issued a notice of suspension at the same time.
The problem hasn't gone away. The FTC says people reported more than $1.1 billion lost to government and business impersonation scams in 2023, and the FBI's IC3 counted $3,046,598,558 in business email compromise losses in 2025, a category that covers business email scams more broadly than this one.
Same con, new costume. In 2003 it borrowed your registrar's name. In 2026 it borrows the name of the person who built your website. It's one more reason I think every owner should know where their domain actually lives, which I wrote about in Domain Names Are Digital Property.
What we did, and what you can always expect from us
We looked for signs of a breach. At this time, we have found no evidence that Honest Web Designs systems, client websites, or client data were breached in connection with this campaign. The pattern is consistent with scammers using publicly available business information to find potential targets.
We also published a security notice, last updated September 25, 2026, and I've let a small group of clients know directly.
Here's what real email from us looks like. Direct email from me comes from jeff@honestwebdesigns.com. Automated invoices may arrive through FreshBooks, but they'll identify FreshBooks and match a service or project you recognize.
We will never ask you to pay an unexpected invoice sent from a personal Gmail account.
If you're not sure about a message, start a new email to jeff@honestwebdesigns.com, or call or text a number you already have. Don't reply using contact information in the suspicious message.
How to spot it
Most of these tells aren't specific to us. They apply to any email that claims to come from your web person.
- Read the actual address, not just the name. A free Gmail address for an established business is a red flag, and Gmail Help says to check that the sender's name and address match.
- Look for details that don't agree. A different address in the signature, a misspelled domain, or contact details you don't recognize are all bad signs.
- Check whether it's about something you actually have. WordPress updates on a site that isn't WordPress is a giveaway. The FTC says an invoice you don't recognize is fake.
- Notice the pressure. Deadlines and warnings that your site will go down are there to rush you.
- Be wary of payment links and "reply to confirm." Those are how the scam moves to the next step.
- Question any request to pay as "friends and family." A business you hired shouldn't ask you to send money the way you'd pay back a friend.
- Don't be reassured by a familiar face or clean grammar. A real photo can be copied from a public page, and CISA notes that clean writing no longer rules out phishing, since AI makes it easy to polish a scam.
If you got one: what to do
Don't reply, click, or pay. Contact your web person through details you already have.
If you already paid or shared card or bank details, contact your bank or card company right away. I can't promise you'll get the money back, but that call is the first step. If you entered a password, change it and turn on multi-factor authentication, which adds a second step, like a code sent to your phone, when you log in.
If you want to report it, you can:
- Mark it as phishing in your email app.
- Report it to the FTC at ReportFraud.ftc.gov.
- Report it to the FBI's Internet Crime Complaint Center at IC3.gov.
Tell your designer, too. They may not know it's happening. If the email used our name, please let me know, and if you clicked a link, entered a password, or paid, contact me right away.
When in doubt, check with us
This email borrowed our name and my photo, and the tells were right there once you looked: the wrong address, a signature that didn't match, a missing "s," and WordPress updates for a site that doesn't use WordPress. It's never wrong to double-check before you reply or pay.
If you're ever unsure whether something is really from us, or you want a second set of eyes on a strange email, get in touch through the contact page. The security notice has the details on this campaign and how we bill.