What Should You Do If Someone Is Impersonating Your Business by Email?

What should you do if someone is impersonating your business by email?

Report the account right away, and warn your customers that same day. We got the first part right in September 2026. The second part I didn't, and I'd like to save you from making the same mistake.

What happened to us?

On September 17, 2026, somebody sent our clients an email pretending to be me. It came from a Gmail address made to look like ours and asked for $450 for website "renewals." It even used my picture under somebody else's name. A client forwarded it to me that morning.

What did we do right?

We reported the account to Google that morning. Gmail has a form for reporting accounts used for fraud at support.google.com/mail/contact/abuse, where you paste in the email and the address. Google deactivated it the same day. Most email providers have some kind of abuse report, and it's worth the five minutes.

Carrie posted a warning on our Facebook page. A picture of the fake email with "this is NOT from Big Sky" in big red letters and our real email address underneath. It reached a lot of clients fast.

Our clients did the right thing on their own. A few of them replied to the fake address, got a bounce because it had already been shut down, and then called or emailed me directly. That's actually how I found out how far it had gone.

What did we get wrong?

I didn't email all of our clients that morning.

Honestly, I figured that once the address was shut down it couldn't hurt anybody. Wrong. People were still getting that email, still wondering about it, and some were still asking about it weeks later. A short note from me that same day would have saved everybody the guessing.

Next time, everybody hears from me before lunch.

What should the warning email say?

Keep it short. You don't need to explain the whole scam, and something like this covers it:

• That email was not from us.
• Here's our real email address and phone number.
• Don't reply to it, don't click anything, and don't pay it.
• If you already did, call your bank and then call us.

Send it from your real address, to everybody, the same day.

Should you report it anywhere else?

The FTC takes reports at ReportFraud.ftc.gov. You probably won't hear back, but it goes into the database law enforcement uses. If anybody actually lost money, they should also file with the FBI at ic3.gov.

Frequently asked questions

Can you stop someone from opening a fake Gmail with your name in it?

Not ahead of time. Anybody can open a Gmail account in about a minute. What you can control is how fast you report it and how fast your customers hear from you.

Should we post about it publicly?

We did, and I'm glad. It's not embarrassing to be impersonated. It happens to real businesses precisely because they're real, and a public warning helps people a lot more than it hurts you.

Could they fake our actual email address instead of a Gmail?

They can try, but a properly set up domain makes that much harder. Ask whoever runs your email whether your domain has DMARC set up. That's the setting that tells other mail servers what to do with fakes of your real address, like sending them to spam or refusing them outright.

How did they get our clients' email addresses?

We can't know for sure. Contact emails listed on public websites are the most common source, which is part of why this can happen to anybody.

Let's talk

If somebody's pretending to be your business and you're not sure what to do first, call me at 979-217-1544.

Tom Bruch has built websites since 1998 and is the owner of Big Sky Internet Design.