How Can You Tell a Website Renewal Email Is a Scam?

How can you tell a website renewal email is a scam?

On September 17, 2026, at 3:28 in the morning, somebody sent an email to some of our clients pretending to be me. It had my name at the top, the real Big Sky logo on it and a link to our real About page, and honestly it looked very legit.

It said I had taken a closer look at their website, was "genuinely impressed" with how it was built, and wanted to warn them that their domain and a bunch of their plugins were coming up for renewal. Total cost, 450. I'd be happy to send over a payment link and get right on it.

I didn't send it. Google shut that address down the same day, but the email was good enough that it's worth walking through, because the next one might have your web designer's name on it, or your vet's, or anybody else you do business with.

What gave it away?

Five things, once you knew to look.

Clue #1: It was signed "Mark Abrams." The top said Tom Bruch and the bottom said Mark Abrams, Founder. I have never once been Mark Abrams. Here's the kicker though, the picture next to his name WAS me. He probably grabbed it right off our About page.

Clue #2: It came from a Gmail address. This is the one most people miss. The name you see on an email is whatever the sender typed in, so anybody can type "Tom Bruch," and you have to look at the actual address next to the name. This one was [email protected], which looks close enough at a glance. My real addresses are [email protected] and [email protected], and we never send business email from Gmail.

Clue #3: It wanted money for themes and plugins. That's WordPress talk. We don't build WordPress sites and never have, so there aren't any themes or plugins to renew. From the scammer's side it was a safe bet, since there are millions of WordPress sites out there and most owners wouldn't know the difference.

Clue #4: It said "Hi There." I've known most of our clients for years. I'd use your name.

Clue #5: It was in a hurry. Pay now, before anything expires. Rushing you to pay before something bad happens is about the oldest trick there is.

Can you count on spotting the clues next time?

No, and that's the real lesson here. The next one will be better. "Mark" will probably sign it Tom, and the Gmail address will look even closer to the real thing. These get a little better every round, and eventually you won't be able to catch them by their mistakes.

So what should you actually do?

Use your Spidey Sense! If an email asks for money and ANYTHING about it feels even a little bit off, don't reply to it. Call the person or company at a number you already have, never the one in the email. Or start a brand new email to the address you've always used for them.

That's exactly what some of our clients did, without anybody telling them to. They replied to "Mark," got a bounce because Google had already shut the account down, and then turned around and called me. That's how I found out how far it had gone.

For the record, real invoices from us come from my real address with an invoice number on them, same as they always have. If one ever looks strange to you, call me. I'd much rather get that call.

Frequently asked questions

Do real web designers send renewal notices?

Some do, for things like domain renewals. A real one comes from the address you already know and matches an invoice or account you recognize. If something is off, call before you pay.

Can a scammer make an email look like it came from my web designer's actual address?

That's harder than faking the name, and a lot of businesses have protections set up that push those fakes into spam. That's exactly why most scammers use a free Gmail account with a close-looking name instead. Check the address every time.

What should I do if I got one of these?

Don't reply and don't click anything. Mark it as spam or phishing so your email provider learns from it, then delete it. And let the real company know, so they can warn everybody else.

What if I already paid or replied?

Call your bank today, then call the real company. The sooner they both know, the better.

Let's talk

If you ever get an email about your website that doesn't feel right, call me at 979-217-1544 before you do anything with it.

Tom Bruch has built websites since 1998 and is the owner of Big Sky Internet Design.