Lookalike addresses used to fool your customers: spotting them and what to do

Security·· 54 views· 3 min read

The short answer: a scammer registers a domain almost identical to yours (one letter swapped, an extra hyphen, another extension) and writes to your customers as if they were your company, nearly always to change the bank details for a payment. SPF, DKIM and DMARC do not stop it, because the domain is theirs and correctly set up. The defence is different: read the address carefully, confirm by phone any change of payment details and warn customers before it happens.

What lookalike addresses look like

Trick The real one The fake
Letters that blur together yourcompany.com yourcornpany.com ("rn" looks like "m")
An extra hyphen or letter yourcompany.com your-company.com, yourcompanys.com
Another extension yourcompany.com yourcompany.net
The right name, a free webmail domain ana@ at the company the company name on some free address

Signs of a fake message

1 It asks you to pay into a new account, "because we changed banks".
2 It is in a hurry: "today without fail", "or the service will be cut off".
3 The address is almost the usual one, or the Reply-To differs from the sender: what Reply-To is.
4 It continues a real conversation. Sometimes the scammer has read old messages and replies within the same subject. A familiar subject proves nothing.

What to do

1 Confirm by phone, on a number you already had (not the one in the message), any request to change bank details.
2 Warn customers in writing, in advance: a line on invoices and in your signature, such as "We never change our bank details by e-mail".
3 Register the most obvious variations of your domain, especially the other extension. A domain you hold cannot be used against you.
4 Report the fake domain. If the site or domain is with us, use report abuse. If not, WHOIS shows who manages it, so you can send them the complaint.
If a customer has already paid into the wrong account, the first call is to their bank, as fast as possible. Then keep the messages with their full headers, which are the evidence for the bank and the police.
It may also be your mailbox. If the scammer knew real conversations and amounts, someone may have read your mail. Change passwords and check forwarders: what to do when the account was hacked. For other channels, see fake WhatsApp messages.

Want to protect your name? Register the variations of your domain before someone else does.

Search for a domain

SEE ALSO

How to recognise a phishing e-mail or message, and what to do if you clicked

Someone is sending e-mail in the name of your domain: what SPF, DKIM and DMARC do about it

Replies going to the wrong address: setting Reply-To in webmail and Outlook

Fake WhatsApp messages in your company name: protecting customers from scams

Everyday e-mail habits for a business: To, Cc and Bcc, reply all, subjects and attachments

Your e-mail account has been hacked: what to do in the first hour

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from R118.80/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 2,328 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 2,370 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 3,979 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
Security 2,257 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 2,139 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 78 SMTP credential password lost or leaked: revoke it, create a new one and update the program The short answer: the password of an SMTP credential cannot be recovered, not even by us: it is only shown when you crea...