Two Email Scams Close to Home: What I'd Tell Any Small Business

Email security · Cybersecurity Awareness Month

Since late summer, someone has been sending fake invoices in my name. Then in October, a client's work email was taken over and used to send a fake message to nearly 2,000 people.

Both are cleaned up now. I'm writing about them because October is Cybersecurity Awareness Month, and because what helped wasn't complicated. Most of it is stuff any small business can do, and most of it doesn't take long.

My client, Mary Higdon of Higdon Law, agreed to let me share what happened to her, and I'm grateful she did. If you've ever wondered who really controls your accounts, I wrote about that in Digital Ownership for Small Businesses. This post is what it looks like when someone else tries to take that control.

01

Fake invoices sent in my name

Starting in late summer, some of my clients got emails that looked like they came from me. They came from look-alike Gmail addresses, used my name and my real business address, and warned that a domain renewal and other "required updates" were due by a deadline. The ask was $500. There was no renewal. One client paid before we caught it.

Several clients forwarded the email to me and asked if it was real. That's exactly the right move, and it's how I found out.

Here's what I did. I reported the accounts to Google and to the bulk email service the scammers were using, and that service blocked them. I warned my clients. And I saved every email, header, and payment record, in case anyone needs them later.

Example: the fake email

From: David Martin Design <david.davidmartindesign@gmail.com>
Subject: Website Updates Required by August 25

I recently received a message from the website builder we used to build your website, and I wanted to bring it to your attention. According to the notification, several items require attention before August 25, including the domain renewal, required app setup, and outstanding technical issues identified during the website audit.

If you would like me to proceed with these updates, simply reply "Yes, proceed," and I'll take care of the necessary steps.

• The address. It's a Gmail account. My email always ends in @davidmartindesign.com.
• The deadline. A date a few days away, meant to rush you.
• The vague source. A "website builder" message nobody can check.
• The easy reply. Two words to start the conversation, before the request for money comes.

Being upfront about costs is part of how I work, so a surprise bill from me should always feel strange. If it does, trust that feeling.

02

A client's inbox taken over

In October, Mary reached out because her work email had stopped working. New messages weren't arriving, and the sign-in codes on her phone didn't seem to do anything.

When we dug in, the story went back to August. She got an email from someone she knew and trusted. That person's account had already been hacked. The message led to a page that looked exactly like a Microsoft sign-in. She signed in, and the fake page passed her sign-in along to Microsoft while quietly copying the signed-in session that came back.

That copied session is the important part. Think of it like someone photocopying your building pass right after you've shown your ID at the front desk. Once they had it, the attacker didn't need her password or her phone.

The attacker checked in now and then for about two and a half months. Then, on a Tuesday afternoon, they used her account to send a "Business Proposal" email with an "Open Message" button to nearly 2,000 people from her contacts, including local offices and businesses.

Example: the fake "Business Proposal" email

From: Mary Higdon <mhigdon@higdonlaw.com>
Subject: Higdon Law Business Proposal

Warning shown by Outlook: This sender mhigdon@higdonlaw.com is from outside your organization.

Mary Higdon (mhigdon@higdonlaw.com) just sent you a new message.

Strategic Opportunity - Higdon Law Business Proposal, Partnership Submission & Engagement Scope/Tender Document.pdf Open Message

• The real address. It came from Mary's actual account, because the attacker was inside it. The address alone can't tell you it's safe.
• No personal note. A vague "business proposal" from someone you know, with nothing written in their own words.
• A "PDF" that isn't attached. The document name is just text. The only way in is the button.
• One big button. Buttons like this usually lead to a fake sign-in page. If you weren't expecting it, call the sender first.

They also set up a hidden rule that deleted her incoming mail, added their own sign-in methods to her account, and replied as her to people who asked whether the email was real. Then they deleted those replies so she wouldn't see them.

1. Step 1An email from a trusted contactTheir account was already hacked, so the message looks normal and comes from a real address.
2. Step 2A fake sign-in pageIt looks just like Microsoft. It passes your password and code along to the real site behind the scenes.
3. Step 3Your signed-in session is copiedMicrosoft lets you in, and the fake page keeps a copy of the session it gets back.The step a code can't see
4. Step 4The attacker uses your accountWith the copied session, they don't need your password or your phone.

03

How we cleaned it up

We worked through it together over two days. Here's what that looked like, in plain terms.

1. Locked the attacker out. We changed the password, signed the account out on every device, and removed the attacker's sign-in methods and mail rules.
2. Saved the evidence. Sign-in logs, audit records, and screenshots, in case anyone needs them later.
3. Moved to stronger sign-in. She now uses the Microsoft Authenticator app and a passkey. A passkey can't be captured by a fake sign-in page.
4. Upgraded her plan to Microsoft 365 Business Premium, which adds better email filtering and more control over how and where people can sign in.
5. Set up email authentication. Three records called SPF, DKIM, and DMARC make it harder for anyone to send email pretending to be her domain. I explained what each one does in a case study about a Gmail warning. They live in your domain's DNS settings.
6. Turned off "anyone with the link" file sharing so old shared links can't be passed around.
7. Reached out to her contacts. Mary personally contacted the people the attacker had replied to. Then a short, plain email went out saying the account was secure and asking people to delete the fake message.

None of these steps is exotic. Most small businesses just haven't had a reason to do them yet.

04

Seven things worth doing now

If you take one thing from this post, make it this list. You don't need to do all of it today. Start at the top.

• Set up a passkey on your email account. A passkey only works on the real website, so a fake sign-in page can't use it. Microsoft, Google, and Apple accounts all support them.
• If your email suddenly goes quiet, check your inbox rules. A rule that deletes or moves everything is a common sign that someone else is in your account.
• Look at your account's security info page now and then. If you see a phone or app you don't recognize, remove it and change your password.
• Pause before clicking "Open Message" or "View Document," even when it's from someone you know. If you weren't expecting it, text or call them first.
• Know who has admin access to your email, domain, and website, and how you'd get back in if you were locked out. The same goes for your Google Business Profile.
• Keep backups you control. I use Backblaze for my own files, and I'm happy to help you set up something similar.
• Expect better-written scams. AI has made phishing emails cleaner and more convincing. Judge the request, not the grammar.

Example: the hidden rule

Outlook rule name: ......

If a message arrives in my inbox, delete the message, mark the message as Read and stop processing more rules on this message.

• The name is just dots, so it's easy to overlook in a list of rules.
• It deletes everything and marks it read, so nothing looks unread or out of place.

05

If it happens to you: the first hour

If you think someone is in your email, these steps matter most, roughly in this order.

1. Change your password from a device you trust, not the one you think may be affected.
2. Sign out your other sessions. Microsoft and Google both let you sign out other devices from your account's security page. This is what removes a stolen session.
3. Check inbox rules, forwarding, and sign-in methods. Remove anything you didn't set up yourself.
4. Don't delete anything. Even the scam emails and bounce-backs are evidence.
5. Call whoever handles your IT. If that's no one, this is the kind of technical support I offer.
6. Let your contacts know once the account is secure, so they can delete anything suspicious that came from you.
7. Call your insurance carrier. Some business, cyber, and professional liability policies help with the cost of responding to an incident, and many want to hear about it early.

06

Common questions

Can my email be hacked if I use two-factor authentication?

Yes. Fake sign-in pages can pass your code along to the real site and keep the signed-in session for themselves. Two-factor still blocks a lot of attacks, so keep it on. A passkey closes this particular gap.

What is a passkey?

A passkey is a way to sign in that's tied to your device and to the real website. You confirm it with your face, fingerprint, or device PIN. Because it only works on the real site, a fake page has nothing to capture.

I clicked a link in a suspicious email. What now?

If you only clicked and didn't type anything in, close the page and watch your account for anything unusual. If you entered a password or approved a sign-in, follow the first-hour steps above, starting with changing your password and signing out your other sessions.

Should I report it?

If money was lost, call your bank right away and file a report with the FBI's Internet Crime Complaint Center. Local police can also take a report, and your insurance carrier may ask whether you filed one.

---

One more thing. When this started, I asked the Amplify Bloomington community for advice, and people answered within minutes with referrals and kind words. That mattered more than I expected. Thank you.