Scam Emails Are Getting Harder to Spot

Scam emails used to be easier to recognize. Strange wording, obvious spelling mistakes, suspicious links, or unfamiliar senders often gave them away.

Those warning signs still matter. But a scam email no longer has to look like a scam.

We recently experienced a convincing example involving Ingenious and several of our clients. To be clear, no Ingenious email account, website, client database, or other system was hacked or compromised. Someone simply used publicly available information to impersonate Ingenious' President, Joe Murphy and our company.

A Scam Built From Public Information

Here's what appears to have happened:

• Someone created a Gmail account designed to impersonate Joe
• They worked through the client listings on our public website
• They followed links to client websites and collected publicly listed email addresses
• They used our logo and a publicly available photograph of Joe
• They sent professional-looking warnings about supposed website problems

Fortunately, one of the websites in our client list is a personal project of Joe's, so one of the fraudulent emails eventually reached him directly. We quickly alerted our clients and reported the Gmail account for phishing.  By the way, if you are not signed up to be on our mailing list, simply submit your email address to the sign up form on this page.

The Old Warning Signs Aren't Enough

In 2024, we published a series about verifying the sender, avoiding suspicious links, and being wary of urgent requests.

That advice still applies. What's changed is that scammers can now create messages that look polished and familiar.

A logo isn't proof. A photograph isn't proof. A professional-looking signature isn't proof.

Look at the Actual Sender

Don't rely on the name displayed in your inbox. Check the actual email address.

In this case, the messages did not come from an @ingenious.org address. They came from a Gmail account designed to look connected to Ingenious.

When in Doubt, Verify Separately

If an email asks you to make a payment, click a link, provide information, or address an unexpected problem, take an extra moment before acting.

• Check the complete sender address
• Be cautious with unexpected links or attachments
• Question unusual urgency
• Don't treat branding as verification
• Contact the sender separately using information you already trust.  In this case, email your friends at Ingenious directly.

Even people who work with technology every day sometimes have to look twice. A little extra skepticism can prevent a much bigger problem.

And if you ever receive something that appears to come from Ingenious but doesn't seem quite right, contact us directly. We'd much rather have you ask.