Customers of web designers and web agencies are currently being specifically targeted with fraudulent emails. The senders impersonate the respective agency or its owner and demand payment for supposedly necessary domain renewals, WordPress updates, plugin/theme renewals or maintenance work.
Customers of Design for Humans have also been affected by this scam.
Based on our research so far, this is not an isolated incident. Several web agencies and web designers have reported very similar cases since the beginning of September 2026. The scammers use real names, photographs, information about the agencies and their customers, as well as imitated email signatures.
How does the scam work?
The scammers impersonate the respective web agency in their emails.
They use publicly available information and attempt to make the messages look as credible as possible. Typical information that is copied or imitated includes:
- the name of the web designer or agency,
- a photograph of the web designer,
- the logo or other elements of the brand identity,
- information about the services offered,
- the website address,
- information about existing customers,
- and an imitated email signature.
Important: The email signature does not necessarily have to match the agency’s actual signature. In the case of Design for Humans, a signature was used that was intended to give the impression that it came from the agency, but differed significantly from the signature actually used by the agency.
The email then claims that, for example, a domain renewal, plugin or theme update, or technical maintenance is required for the recipient’s website. A specific payment is requested for this work.
A typical payment demand: 300 euros or dollars
One particularly noticeable feature of the variant currently being observed is the specific payment demand of 300 euros or 300 dollars.
The emails may claim, for example, that a domain needs to be renewed, WordPress updated, or certain plugins or themes renewed. A flat fee of 300 dollars or 300 euros is then requested for these supposedly necessary services.
A payment of 300 also appears in several other publicly documented cases involving web designers and web agencies. However, the exact amount and the specific justification may vary. The recurring combination of an allegedly necessary website service and a payment demand of around 300 dollars or euros is therefore an important warning sign.
Customers of Design for Humans have also been asked to pay €300.
The sender’s email address is a particularly important warning sign
One noticeable feature of the current cases is the use of Gmail addresses that closely resemble the name of the genuine agency.
In the case of Design for Humans, for example, the address
was used.
Design for Humans communicates using email addresses under its own domain.
The fraudulent address is therefore deliberately chosen to appear plausible at first glance: the company name is slightly altered and combined with a generic Gmail mailbox.
This is an important detail: Do not only check the displayed sender name – check the complete email address.
Other affected web agencies have also reported Gmail addresses being used in very similar scams. Gmail appears to be a commonly used delivery method in the cases documented so far. However, this does not mean that Gmail is the only service being used. Other email providers can also be used for this type of impersonation.
Example
Genuine agency:
designforhumans.studio
Fraudulent address:
The missing “s” in “designforhuman” can easily be overlooked when reading quickly.
How do the scammers know the agency’s customers?
This is one of the most important questions surrounding this scam.
The cases documented so far suggest that publicly available information plays an important role.
One possible approach could be:
References / portfolio of a web agency
↓
Identify customers and their websites
↓
Visit the customer’s website
↓
Find the legal notice / contact page
↓
Find the publicly available email address
↓
Contact the customer while impersonating the web agency
Another possible route works in the opposite direction:
Customer’s website
↓
“Website by …” credit or link to the web agency
↓
Identify the web agency
↓
Find further customers through references / portfolio
↓
Research the customers’ contact details
For this, no access to confidential customer data is required.
Public websites can be searched automatically and the information they contain can be collected. Reference pages, portfolio pages, legal notices and publicly visible “Website by …” links in particular can provide enough information for this purpose.
In the case of Design for Humans, the Design for Humans references page was even explicitly linked in the fraudulent email. This is a strong indication that publicly available information about our work and our customers may have played a role in preparing the messages.
Whether the scammers actually started with our references page or collected the information through another public source cannot currently be established with certainty.
Has the web agency’s website been hacked?
No – a hack of the web agency’s website is not necessary for this scam campaign.
This is an important point.
If the scammers know the name, photograph, agency and even its customers, that does not mean that they gained access to the agency’s website or email account.
The information required for this type of scam can be obtained from publicly available sources:
- the agency’s website
- references and portfolio
- publicly visible photographs
- legal notices
- customer websites
- contact pages
- “Website by …” links
An attacker can collect this information automatically and then construct a convincing false identity.
The use of a genuine photograph in an email is therefore not evidence of a security breach either. Photographs of web designers and agency owners are often publicly available and can easily be copied.
What is known in the case of Design for Humans?
The fraudulent email we received was not sent through our own mail server. The complete email headers show a Gmail server as the actual sending server. The Return-Path is listed as:
This suggests that the scammers used a separate Gmail account to impersonate Design for Humans.
However, access to the agency’s website or email account is simply not necessary for the scam campaign described here.
The web designer’s photograph is genuine – but the email is still fraudulent
In our case, a genuine photograph of Jens Hoffmeister was used. The photograph is publicly available on the Design for Humans website.
This illustrates very clearly how the scam works.
The scammers do not need access to private files or internal systems. A publicly available photograph can simply be downloaded from a website and incorporated into a fraudulent email signature.
The same applies to:
- names
- company logos
- telephone numbers
- addresses
- website links
- service descriptions
- references
- social media profiles
The more publicly available information is included in the email, the more convincing a fraudulent message can appear.
Typical characteristics of fraudulent emails
The messages can sometimes look remarkably professional. There are nevertheless several typical warning signs.
1. The sender’s email address does not belong to the agency
This is one of the most important indicators.
An email can display the name of a genuine employee or the agency as the sender. What matters, however, is the actual email address.
Addresses such as these are particularly suspicious:
or
if the genuine agency normally communicates using its own domain.
2. The address resembles the company name
The scammers appear to deliberately use slightly altered company names.
This can make an address look plausible when read quickly.
In the case of Design for Humans:
Genuine brand: Design for Humans
Fraudulent address:
A single missing “s” can easily be overlooked.
3. An unexpected payment is requested
The email asks for money for services that have not previously been discussed.
Typical terms include:
- domain renewal
- plugin licences
- theme licences
- WordPress updates
- security updates
- maintenance work
It is particularly suspicious if a flat fee – for example €300 or $300 – is suddenly requested.
4. The message creates technical or time pressure
The emails often refer to possible consequences such as:
- security issues
- compatibility problems
- performance issues
- website outages
- expiring licences
- necessary updates
The aim is to encourage the recipient to act quickly rather than taking the time to verify the message.
5. The email contains genuine information
This makes the scam particularly convincing.
The scammers may know the actual name of the agency, its website or even the WordPress technology being used.
This is not proof that the email is genuine.
Such information may be publicly available.
6. The photograph is genuine
This may also be used deliberately.
A genuine photograph of an employee or agency owner is intended to create trust.
However, the photograph does not prove that the message actually came from that person or agency.
7. The signature looks official
The scammers can create a signature designed to look like an official one.
It does not even have to match the agency’s actual signature.
A photograph, company name, logo and address can be enough to create an official impression at a quick glance.
8. The email links to the genuine website
A link to the actual website is not proof that the message is genuine.
In the case of Design for Humans, the fraudulent email even linked to our genuine references page.
This can easily create the impression:
„The email must be genuine – after all, the link actually leads to the web agency’s website.“
This is a misconception. Anyone can insert a link to the genuine website into an email.
9. A simple reply is supposed to trigger the process
In the case of Design for Humans, recipients were asked simply to reply with:
“Yes, please proceed”
This is also a warning sign when such a request is unexpected.
Such a reply may also confirm to the scammers that the email address is active and that someone is actually responding to the message.
What should you do if you receive such an email?
Do not reply.
Do not make any payment.
Do not click any links in the suspicious message.
Do not open any attachments.
If you are unsure whether a message genuinely came from your web agency, contact the agency using a previously known communication channel.
For example:
- call a telephone number you already have on file,
- send a new email to the address you have previously used,
- or visit the agency’s website yourself and use the contact details provided there.
Where possible, do not use the contact details provided in the suspicious email.
What should you do if you have already replied or paid?
If you have already replied to such an email, there is no immediate reason to panic.
If no payment has been made, stop communicating with the sender.
If money has already been transferred, contact your bank or the relevant payment provider as quickly as possible.
If you have provided login credentials, credit card details or other confidential information, take steps to secure them immediately.
In this situation, do not simply delete the email. Keep the original message, including the complete email headers. This information may be important for further investigation or for reporting the incident to the authorities.
What can web agencies do?
Web agencies should inform their customers about this scam as soon as similar cases occur.
In addition, some basic measures are advisable:
- inform customers through official communication channels,
- establish an independent verification method for payment requests,
- retain suspicious messages and complete email headers
A clear rule for customers can be particularly helpful, for example:
We do not request unexpected payments exclusively by email. If you are unsure about a payment request, please contact us directly using the telephone number you already have on file.
This provides an additional layer of security even if someone copies the agency’s name, photograph, logo or email address.
Why are we publishing this article?
We are publishing this information because several customers of Design for Humans have now received such a message, and we assume that other web designers and agencies may also be affected.
If you are a web designer or run a web agency and receive similar messages, it is worth actively informing your customers.
If you are a customer and receive such an email, first check the sender’s email address and contact your web agency using a known communication channel.
The more cases that are documented, the easier it will be to understand how this scam works and how other businesses can be protected against it.
Conclusion
The most important point is:
An email can look highly convincing and still be fraudulent.
A genuine name, a genuine photograph, a genuine website, genuine information about the website and even genuine information about the web agency providing the service are not proof that the message actually came from the agency.
Particular caution is warranted if an unexpected email:
- comes from a personal Gmail or other external address,
- uses an address that resembles the company name,
- requests payment for domains, plugins, themes or maintenance,
- refers to technical problems or creates a sense of urgency,
- uses a genuine photograph or an imitated signature,
- and asks for a simple confirmation or immediate payment.
When in doubt: do not reply, do not pay, and contact the web agency using a communication channel you already know.
According to the reports currently available, this scam does not affect isolated businesses only. Several web agencies and web designers have publicly reported very similar cases in 2026. The details vary, but the underlying pattern is strikingly similar: impersonation of a web agency, publicly researched information, targeted contact with customers, and a payment request for supposedly necessary website services.