Devstars
To spot a fake business enquiry email, ignore the writing and check three things. Does the sending domain actually belong to the company being claimed. Does every link go where its label says it goes. And does the sender’s photograph appear anywhere else online. The writing itself is now the least reliable signal you have.
We learned that properly this month. Two convincing enquiries came through a contact form on one of our sites. Both got a reply from us before anyone smelled a rat. Then a reverse image search turned up three different women, posing in the same room, in the same blazer.
One of the enquiries carried a headshot in the signature. A professional-looking woman in a cream satin blazer, taking a selfie in an expensive-looking room.
Running that image through Google turned up two more versions of it. Different woman each time. Different face, different skin tone, different nose, different hair.
Everything else was identical. The mirrored wall behind her. The cream table lamp, and its reflection. The floating stone shelf. A white sculpture of a face holding a butterfly. The stacked round boxes. The reed diffuser. The little coloured books on the console table.
Same blazer. Same white V-neck underneath. Same fine gold chain with a small dark pendant. Same round black pin on the lapel. Same arm-extended pose, same crop, same tilt of the head.
Three real women do not share a shelf arrangement down to the millimetre. That is one photograph with three faces put onto it.
This is not three scams. It is one operation running a persona factory.
One scene, many faces, many names, many throwaway domains. The faces are the asset. The company names are disposable packaging.
Three things follow from that, and all three matter.
Blocking domains is a waste of time. The web addresses these people send from are built to be abandoned. Block one and the same operation is back next month under a different company name with a different face.
“She looks real” is not a check any more. A convincing person can be manufactured in minutes, complete with a social profile built from the same images. Finding a profile proves nothing.
They are running at volume. Nobody builds a factory to make three of something. If it reached us, it is reaching your business too.
The first claimed to be from a well-known global appliance brand. Beautifully written, flattering about our work, and dangling a marketing budget of forty-five thousand US dollars a month.
The tell was the web address. The form captured one domain, the reply arrived from a different one, and neither was the brand’s real website. The company’s actual head office address had been lifted from a public page and pasted into the signature. The logo was loading from a third fake domain.
And the real purpose was in the last line. A partnership document, coming in the next email. That document is the attack. Everything before it is wrapping paper.
The second claimed to be a dental practice wanting a website rebuild and some search work. Exactly what we do, which is why it got a reply.
The follow-up contained a booking link. The label said booking link. The address underneath pointed at a web address built to imitate a well-known scheduling service, on a domain that misspelled the practice’s own name by one letter. Then it asked a question that gives the whole game away. Once you have booked, could you confirm which email address you used.
That question is not admin. It is confirming which of your mailboxes is live and watched by a human.
For twenty years we all taught people the same tells. Bad spelling. Clumsy grammar. Odd phrasing. Too good to be true.
The reality is that none of that survives contact with the tools now available. Both of these were better written than most genuine enquiries we receive. Well structured, correctly punctuated, warm without being creepy.
Here is the thing worth knowing. Polished writing is not evidence that something is real. It is the standard wrapper, because it is now the cheapest part of the job.
Spend a minute looking at where the effort went, and you can see what they care about. The copy and the web addresses got real attention. The photography got none, because reusing one scene across many personas is cheaper than staging three.
That gap is where you catch them.
None of this needs software. It needs about ninety seconds and the discipline to do it before you reply. The NCSC’s guidance on phishing and spoofed emails recommends these same fundamentals.
And one that costs nothing. If something arrives through your contact forms claiming to be a household-name brand, ring their head office. Large companies do not hire agencies through web forms.
We have been building for clients since 2003, and a lot of that work is the contact forms themselves. So we treat what arrives through them as our problem too.
Our inbound enquiries already went through a daily automated triage. It sorted real prospects from noise, but it was reading the message like a human reads a message, which is exactly the weakness these attacks are built for.
So we rebuilt the front of it. Before anything else now, it pulls out the facts the attacker cannot dress up. Where the message really came from. Whether the sender’s domain matches the company they claim. Whether any link goes somewhere other than it says. What the message is quietly steering you toward opening.
Those facts go to a decision model that weighs them together, because no single one of them proves anything on its own. A free email address is not a crime. A slightly odd domain could be a rebrand. It is the combination that convicts.
We tested it on both attacks and on a genuine note from a client. It caught both attacks outright and left the real client alone. More usefully, it caught the appliance brand one on the very first message, before any reply, on the strength of the domain alone.
The part it cannot do is the photograph. No automated check reverse-searches an image safely. So that stays a human step, and the system’s job is to tell you when to bother.
If you have a contact form, you have a door onto the internet that anyone can knock on. Most businesses watch what goes out of their marketing and nothing at all of what comes in.
The damage is not theoretical. A harvested password on a marketing inbox reaches the customer database, the ad accounts and the invoicing. The enquiry form is often the softest entry point a business owns, because it is designed to welcome strangers.
Worth an hour of someone’s time this month. Look at the last twenty enquiries you received. Check the domains, hover the links, and search a couple of the photographs. You will either be reassured or you will find something, and both outcomes are worth knowing.
Key takeaway: Judge an enquiry on where it came from and where it wants you to go, never on how well it is written.
Next step: If you would like a second pair of eyes on what is coming through your forms, book a fifteen-minute call and we will take a look together.
Tell me what you’re trying to fix. Half an hour, no pitch, no slide deck.
If we’re the right fit we’ll talk about what’s next. If we’re not, I’ll point you to someone who is.
