We got 14 inbound messages through our website contact form this week. Exciting, so I went through each one. Eleven were fraud.
Here is the breakdown.
- One was a verified, real lead. A tier-one auto supplier with a real permit and a specific scope. We called them immediately.
- Two were legitimate vendor intros. Always like good partners. Happy they reached out.
- The other eleven were fraud.
Not spam.
Fraud.
The kind built to fool you, waste your time, and stop forward progress when we're trying to move fast.
Here is what they actually looked like, so you can spot what they're doing.
A company called "Automation Service" reached out.
Sounds interesting. Fits our space.
Except the domain was autoRNationservice dot com. That is an r and an n placed together to mimic an m. At a glance it reads automation. It is not.
Two different inquiries came in: one from "Evans General Contractors" and one from "Kerotest Manufacturing". Both had the exact same phone number.
A plastics company emailed from dinesAlplastics.
The real company is dinesOlplastics.
Plus, Maryland phone number for an Ohio company.
Several included a friendly line about having "a document to share." That document is usually how the malware gets in.
Here is the part that matters.
Every one of these is engineered to beat speed, waste our time, and distract us.
They are counting on you being busy, scanning fast, and clicking before you read the domain.
Before anyone on our team replies to an inbound, we check three things.
- The exact domain spelling, letter by letter.
- Whether the phone number shows up anywhere else.
- Whether they are pushing a document or a payment before any real conversation has happened.
You can build a system to do this, an SOP, or just slow down.
Slow is smooth. Smooth is safe.