Email impersonation scams targeting web design agencies.

This warning is for website designers, digital agencies, hosting providers and the clients who rely on them. It is based on messages reported to 360 Web Firm in October 2026, supported by preserved message evidence and the official guidance linked below. The examples show what to recognize and how to respond.

What happened to 360 Web Firm?

On October 20, 2026, clients received emails from an unauthorized Gmail address pretending to be our business. The sender used a familiar name and a copied business signature, claimed that a domain needed urgent renewal, and offered help with SEO, conversion optimization, speed and security. A client checked with us instead of assuming the message was genuine.

We reviewed evidence for two distinct messages sent to different client addresses. They used the same subject and substantially the same body. Different message identifiers and recipient information distinguished the deliveries. That establishes at least two messages; it does not establish the total number of people contacted.

We warned clients through our established email addresses, added a homepage notice, and reported the matter to the Cornwall Police Service, the Canadian Anti-Fraud Centre and Google/Gmail. Further details are being kept private.

Two redacted email examples from the incident

These are anonymized text excerpts, not screenshots or downloadable original messages. Personal names, recipient addresses, the sender’s account name, business-signature details and unique tracking information are withheld. Square brackets mark redactions. The quoted body wording is retained, including the unusual date wording. Both examples relate to the same email template, not two different scam campaigns.

Example A: urgent renewal followed by website-service offers

Why it matters: the message combines fear of an outage with familiar agency services. It asks for a reply before providing the next details. A message does not need to contain a payment link to deserve verification. The claim about a renewal deadline was not independently established by this email.

Example B: the same approach sent to another client

Why it matters: a second independently addressed message helps an agency recognize that the issue may affect more than the first person who reports it. Preserve each original separately. Do not assume a forwarded copy is a new target, and do not assume everyone on your client list received the email.

Warning signs agencies should teach clients to recognize

• An unfamiliar full sender address. Expand the sender details instead of relying on the display name. A business name written into an address or signature is not proof of ownership.
• A renewal deadline you cannot verify. Check the actual registrar account or your established agency contact. The email’s urgency is not evidence that the domain is expiring.
• A vague “website support team.” Ask which provider, account and domain the request concerns through a separate trusted conversation.
• Broad claims without supporting findings. SEO, speed and security can sound convincing when no specific assessment or authorized project is identified.
• A familiar signature attached to an unfamiliar request. Logos, titles, websites and sign-offs can be copied from public material or earlier correspondence.
• A push to continue the conversation or change payment arrangements. Treat new banking details, unexpected invoices and requests for account access as reasons to verify independently.

Spelling errors can be a clue, but they are not a reliable test. A convincing impersonation email may be well written, and a genuine contact may make a typo. What matters is whether the identity and request can be independently verified. Google’s guidance recommends contacting familiar people using the details you normally use. [1]

Why a Gmail address or authentication “pass” is not proof of identity

Gmail is a legitimate email service used by real businesses and individuals. Its presence alone does not make a message fraudulent. The issue in this case was that an unauthorized account claimed to represent an existing agency.

The supplied receiving headers reported SPF, DKIM and DMARC passes. That supported delivery through the email provider using the address shown. It did not establish that the account holder was entitled to use our identity. Google explicitly notes that spammers can authenticate mail too. [2]

For agencies, the practical distinction is between spoofing your own domain and impersonating your business from a different domain or mailbox. SPF, DKIM and DMARC are valuable domain controls, but your domain policy does not give you control over a separate Gmail account. A perfect domain configuration cannot by itself stop someone copying your display name and signature.

Keep email-authentication checks and account protection in your security routine, while also teaching clients to verify unusual requests. Neither technical configuration nor client education is sufficient on its own.

Does Google require a phone number?

Google says phone verification is sometimes required when creating an account or signing in. That does not mean every Gmail account has a verified phone number, or that any number associated with an account identifies its current operator. [4]

A Gmail account is not automatically anonymous. The existence of an account does not guarantee that a member of the public can trace the person using it.

What email headers can tell you—and their limits

Full headers can help identify delivery routes, timestamps, authentication results and message identifiers. They are useful for separating an original message from later forwards and for building a clear timeline.

A Google, Microsoft or other provider’s server address is not automatically the sender’s home or device address. A country label attached to a relay, or a time-zone offset in a date, does not establish the person’s location.

Google documents a process for reviewing government requests for user information. Any access to non-public account records depends on the records available and the applicable process. A public header lookup is not a substitute, and no outcome can be promised. [5]

Preserve the original before creating a public example

• Save the original message in the mail system’s supported format, such as EML or MSG, and retain the full headers where available.
• Keep the subject, received date, recipient, sender address and message identifier together in a private incident record.
• Record how each item was obtained. A screenshot or copied text is a useful derivative, but should not be described as an untouched original email file.
• Keep an unchanged evidence copy. Redact a separate copy for public awareness; never overwrite the original with the redacted version.
• Avoid loading remote images or following links merely to investigate. Preserve any tracking references privately without fetching them.

In Gmail on a computer, open the original message and use the menu beside Reply, then Show original, to view its headers. Google provides the current instructions. [3] The Canadian Centre for Cyber Security also explains the risks of remote-image tracking and recommends controlling external-image loading. [7]

A practical response plan for web design agencies

1. Confirm the report and give the client a clear answer

Tell the client whether the message was authorized. Ask them to preserve it and say whether they replied, paid, shared information or entered credentials. Thank them for checking. Do not turn a good-faith verification question into a technical lecture.

2. Warn clients through established channels

Use the email addresses and communication methods clients already recognize. Publish a concise website notice with a known contact route. If you send a group warning, protect recipient privacy with an appropriate mailing system or BCC. Explain what clients should do, not just that a scam exists.

3. Check your own accounts without assuming a breach

Review sign-in activity, forwarding rules, recovery details, connected applications and administrator access. Check that multi-factor authentication is enabled. Impersonation from a separate mailbox is not proof that your systems were accessed, but an account review can help distinguish separate risks. [7]

4. Preserve and report

Build a private timeline, preserve originals, and record report references and later replies. Ask actual recipients to report the original suspicious message to their provider. Make sure they do not accidentally report your legitimate customer warning or an innocent client’s forwarding email.

5. Standardize verification for payments and renewals

Agree with clients on how invoices, domain renewals and payment-detail changes are handled. Require a separate confirmation for changes to bank details or unusual access requests. Keep an internal record of who manages each domain, when it renews and who is authorized to approve it.

6. Keep the warning useful if the address changes

Blocking one address can reduce messages from that account, but the same approach can appear under another name. Teach the pattern: familiar identity, unfamiliar sender, unexpected request and pressure to act. Avoid making a single blocked address your entire response.

What clients should do if they receive a suspicious request

1. Pause. Do not pay, reply, open attachments or provide account information while the request is unverified.
2. Contact the real agency separately. Use a saved number, an existing trusted conversation or the website address you already know. Do not use newly supplied contact details in the suspicious message.
3. Check the underlying claim. Confirm the domain and renewal status through the registrar or authorized provider.
4. Preserve the message and report it. Share the original privately with the agency or relevant reporting channel.
5. If you already acted, explain exactly what happened. If money was sent, contact your payment provider promptly. If credentials were entered, secure the affected account through the provider’s real website and notify the agency so it can assess access.

Where to report impersonation and suspected fraud

Your local police department: Report suspected fraud or impersonation to your local police department through its official non-emergency reporting channel. Ask how to submit your evidence securely, and keep the report or reference number for follow-up.

Collect the original emails and complete headers: Preserve every original suspicious email, including its full email headers—not just the visible From, To and Subject fields. If clients received the messages, ask them to export the originals in a supported format such as EML or MSG and retain the complete headers. A screenshot, copied text or ordinary forwarded message may omit important technical evidence. Keep unchanged originals, retain any attachments without opening them, and provide the evidence privately to police through the method they request. Redact separate copies for any public warning; never overwrite the originals.

Canada: the Canadian Anti-Fraud Centre accepts reports from victims and witnesses. It says local police investigate incidents, while the CAFC maintains and shares information to support investigations. Reporting to the CAFC is not the same as filing a local police report. Use the official Report Cybercrime and Fraud portal and contact your local police where appropriate. [6]

Gmail: recipients using Gmail on a computer can open the suspicious message, choose the menu beside Reply, and select Report phishing. Use the provider’s official reporting guidance if you use another mail service. Preserve the original before removing it from your own records. [1]

Describe what the evidence shows. Include relevant dates, original messages and any actual loss or account exposure. Avoid claiming an offender’s identity or location from a relay IP, and do not promise clients that a report will immediately remove an account.

Questions other agencies may have

Does this mean our client list was stolen?

Not necessarily. This incident does not establish how the recipients were selected. Treat a stolen client list as a possibility to assess only if evidence supports it, not as a conclusion drawn from the existence of an impersonation email.

Should we publish the full email headers?

Keep full headers and originals for private reporting. A public article can use redacted text examples. Headers, forwarding chains and signatures may contain client details, message identifiers and other information that readers do not need.

Should we reply to confront the sender?

For this type of client-protection response, a direct confrontation is unnecessary. Warn clients, preserve evidence and use the reporting channels. Follow any case-specific directions provided by police.

Will further details about this incident be published?

Further details are being kept private. This article focuses on helping agencies and clients recognize impersonation emails, verify unexpected requests and preserve evidence for the appropriate authorities.

Is a genuine-looking signature enough to trust a renewal email?

No. Verify the full sender address and the request through an independently known contact. A signature, real business website link or familiar service description can be copied.

Protect the relationship your clients already trust

The most useful intervention in this incident was simple: a client asked us whether the email was real. Make that easy. Give people a clear verification route, respond calmly and keep renewal and billing practices predictable.

For broader prevention, see our website security services, guide to authenticated website email and administrator access guidance. These controls support a safer business, while independent verification remains essential when someone imitates a trusted contact.

Sources and editorial notes

Published October 22, 2026. Incident details come from messages and headers supplied to 360 Web Firm and the owner’s confirmed reporting actions. Client identities, personal surnames, original sender-account details and private investigative material are intentionally omitted. The two examples are redacted excerpts; they are not new messages or claims of separate campaigns. Official guidance was checked for this publication.

1. Google: avoid and report phishing emails
2. Google: check message authentication
3. Google: view full email headers
4. Google: account verification
5. Google: government requests for user information
6. Canadian Anti-Fraud Centre: reporting fraud
7. Canadian Centre for Cyber Security: managing email