How One of My Clients Lost $200 to an Email Imposter Scam

How One of My Clients Lost $200 to an Email Imposter Scam

Over the past few months, I started noticing something disturbing happening behind the scenes at MAjor Designs. Clients were receiving emails that looked like they came from me, but they didn’t.

The scammers were creating fake Gmail accounts using names closely tied to my business, including addresses like stefan.majordesigns@gmail.com and hello.majordesigns@gmail.com. The emails were written professionally enough to look legitimate at a quick glance, especially to clients who regularly communicate with me about invoices, websites, hosting, and ongoing projects.

Imposter email screenshot number 1

At first, the emails were caught quickly. Clients forwarded them to me asking if they were real. In every case, they were fake. Then one finally slipped through. A client sent approximately $200 to one of these scammers believing they were paying a legitimate invoice from MAjor Designs. That moment changed this from “annoying spam” into something much more serious.

These Scams Are Getting Much Harder to Spot

A few years ago, scam emails were usually easy to identify. Broken English, obvious spelling mistakes, strange formatting, and ridiculous stories made them stand out immediately. That’s no longer the case. Today’s scammers are using AI tools to generate cleaner writing, more believable messages, and realistic communication styles. Some of these emails read better than legitimate business emails. They mimic tone, structure, and urgency surprisingly well.

The dangerous part is they don’t need to hack your website or compromise your server to cause damage.

They simply impersonate someone you already trust. In my case, the attackers used Gmail accounts designed to visually resemble MAjor Designs communication. If someone is busy, distracted, checking email on a phone, or handling multiple invoices at once, it becomes very easy to miss subtle differences in an email address. That’s exactly what these attackers are counting on.

What Made These Emails Convincing

The fake emails weren’t random. They appeared targeted. The scammers seemed to know:

One email even included a tracking pixel hosted through a mail tracking platform. That means the scammer could potentially monitor whether the email was opened, helping them decide which victims were engaging with the message. That level of sophistication used to be associated with large-scale cybercrime operations. Now it’s becoming common. And with AI becoming more accessible, this problem is only going to grow.

The Biggest Red Flag Was the Email Address

The biggest lesson from all of this is painfully simple:

Most people glance at the sender name and move on. Scammers know this. That’s why they create addresses that feel familiar enough to pass a quick visual check. For example, if you regularly work with @majordesigns.co, your brain may not immediately catch the difference when seeing something like:

Especially on mobile devices where email clients often hide the full sender address until you tap deeper into the message. That tiny moment of distraction can be all it takes.

AI Is Going to Make This Problem Worse

This is the part businesses really need to prepare for.

AI is lowering the barrier for scammers dramatically. They no longer need to be good writers. They no longer need to spend hours crafting believable phishing emails. They can generate polished, convincing messages in seconds. AI tools can already:

As AI agents continue advancing, I fully expect attackers to automate entire impersonation campaigns. Businesses and customers are going to see more realistic scams, more personalization, and more pressure tactics designed to create urgency.

The old advice of “you can tell because it looks fake” is becoming less reliable every year.

How Businesses and Clients Can Protect Themselves

The best defense is slowing down. Scammers rely on urgency and routine. They want someone to react quickly without verifying details. If you receive:

Pause for a minute. Verify the request through another communication method. Call the person. Start a fresh email thread using the contact information you already have saved. Do not reply directly to suspicious emails. For my own clients, I’ve started reminding them:

Even those reminders may not stop every attack, but they increase awareness — and awareness matters.

Small Businesses Are Being Targeted More Frequently

Many people assume cybercrime mainly targets large corporations. That’s no longer true. Small businesses are often easier targets because they typically don’t have dedicated security teams or formal verification procedures. Attackers know smaller companies move quickly, trust relationships more personally, and may not have strict financial controls in place.

That makes impersonation scams incredibly effective.

Ironically, smaller businesses also tend to suffer more from smaller financial losses. A fraudulent $200 payment might not cripple a company, but repeated incidents absolutely add up — especially when trust becomes part of the damage.

Final Thoughts

I wish I could say this was an isolated incident. It isn’t. This type of impersonation scam is becoming increasingly common, increasingly believable, and increasingly dangerous.

The frustrating part is the technology itself isn’t evil. AI is an incredible tool when used responsibly. I use AI regularly in development, content creation, and problem-solving work. But like every major technological advancement, bad actors are finding ways to weaponize it faster than most people can adapt.

The best thing businesses and individuals can do right now is stay skeptical, stay observant, and slow down before sending money or sensitive information. Because sometimes the difference between a legitimate email and a scam is only a few characters in an email address.