Web Design Agency Impersonation Scams: It Happened to Us Three Times

Since September 2026, someone has been emailing our clients and pretending to be us. It has happened three times so far: twice in Sam's name and once in Harriet's, each time from a Gmail address made to look like ours.

None of those emails came from Brambla, and nothing of ours was hacked. Here's what the fakes looked like, what we did about them, and how to spot one, whoever builds your website.

Key takeaways

• Three fake emails have gone to our clients since September 2026, all from Gmail addresses dressed up to look like ours.
• Each one pushed something urgent: a domain renewal, "updates" before a deadline, or a "WordPress platform update". We don't build on WordPress.
• Nothing was hacked. The senders use public information, such as our names and logo, to make the email look real.
• We warned our clients by email the same day each time, and we keep a page that lists every fake: How We Contact You.
• If one reaches you, don't reply, click or pay. Forward it to report@phishing.gov.uk, then delete it.

What happened: three fake emails in a month

Look closely at those addresses. The first spells our name "bramble". The other two start with hello.brambla.co, so at a glance they read like hello@brambla.co.uk. They aren't. Every real email from us ends in @brambla.co.uk.

The three emails had the same shape:

• A free email address. Gmail, made to look like ours.
• A deadline or an urgent "update". A domain about to lapse, a deadline that didn't exist, a platform update nobody needed.
• WordPress. All three offered WordPress work or a WordPress update. We build on Next.js, never WordPress, so for our clients that line alone gives the game away.
• A real name and a real-looking signature. Sam's name, Harriet's name, a job title, sometimes our logo or a photo. Names, logos and photos are easy to copy from the web, and a job title is easy to make up.
• A request to reply. The October emails asked the reader to reply so the sender could "proceed" or "take care of the update". When one client replied to the second fake, the sender answered within three minutes. In our warning to clients we said what we think comes next: "usually a request for payment or a login".

One of the October fakes landed in a client's spam folder. Not all of them will.

Nothing was hacked

When a fake email uses your designer's name, it's natural to wonder whether their systems were broken into. In our case, there's no sign of that. Our clients' websites haven't been touched, and the fakes don't need anything private: our names, our logo and our phone number are all public, because that's how clients find and contact us.

Other agencies hit by the same scam say where the client list comes from. BragDeal, a web agency, wrote in March 2026 that a scammer will "open the portfolio page, and write down every single client listed", then collect each client's general contact email from the client's own website. Rob Saunders, a web developer whose clients were sent fakes from info.robert.saunders@gmail.com, put it plainly: "Nothing was hacked and no data was leaked. This was a classic impersonation scam, built on publicly available information."

Email security settings on our own domain can't stop this, because these emails never use our domain. Anyone can open a Gmail account with our name in the address.

It's not just us

This is a known pattern, and AI tools now make it easier than ever to copy a real business's name, wording and photos.

• A UK agency, earlier this year: Bookswarm warned its clients in January 2026 about fakes telling them that their domain and plugins "need to be renewed before January 28th". Its owner wrote: "I would never send work emails from a personal Gmail account, in this case simon.bookswarm@gmail.com". In May more fakes went out, and Google deactivated the address they came from.
• Squarespace designers: Agave Studio writes that "Squarespace has officially confirmed that scammers are impersonating legitimate web designers across the Circle Partner program, and the activity has escalated significantly since late 2025", and that "a handful of business owners have lost money to this scheme."
• Domain expiry fakes: JV Media Design describes a client who was told their domain would expire in 5 days. It "actually doesn't expire until 2029".
• Across UK businesses: in the government's Cyber security breaches survey 2025/2026, published on 30 April 2026, 38% of businesses had a phishing attack in the previous 12 months, and 12% had people impersonating them or their staff in emails or online.

What we did

1. We warned our clients the same day, every time. We emailed them from hello@brambla.co.uk, one email each. It showed what the fake looked like, the signs that gave it away, and what to do. The September one went out the evening we heard about it. The October ones went out within hours of us hearing about them.

2. We made a page for it. How We Contact You went live in September. It sets out how we contact clients (only from @brambla.co.uk addresses, and by phone on 020 8050 2803), what we never do (urgent payments, domain renewals or bank-detail changes by email), and every fake we know of, newest first. We add each new one to it.

3. We put a line in our emails. Since September, our automatic emails, from enquiry replies to billing emails, carry this line: "We only ever email you from an @brambla.co.uk address and never ask for urgent payments by email. Not sure a message is from us? Call 020 8050 2803."

4. We reported it. We forwarded the first fake to the NCSC's Suspicious Email Reporting Service (report@phishing.gov.uk) and reported the Gmail account to Google. Reporting is worth the minute it takes: the NCSC says that by September 2026 it had received more than 59.6 million reports, which led to 263,700 scams being removed across 466,300 web addresses.

5. We kept talking to people. Harriet messaged clients directly the first time, and clients who weren't sure forwarded the emails to us. That's exactly what we want: if something looks off, ask us.

There's more we've done that we won't go into here, because spelling it out would only help the people sending these.

How to spot a fake email from your web designer

These signs hold for any agency or freelancer, not just us:

• Check the address, not the name. A display name can say anything. Look at the full address. A free email address (Gmail, Outlook, Yahoo) for a business that normally emails from its own domain is a red flag.
• Be wary of deadlines. "Your domain expires in a few days" is an old trick. If you're not sure, check the expiry date with whoever your domain is registered with.
• Question "updates" you didn't ask for. Has your designer ever emailed you like this before?
• Watch for "just reply". A request to reply "yes" or let them "arrange everything" is often the first step towards a payment or a login request.
• Check with a number you already have. Use the phone number or email address you know, not the details in the message.

What to do if you get one

1. Don't reply, click any links or pay anything.
2. Forward it to report@phishing.gov.uk, then delete it.
3. If you've already paid or shared bank details, call your bank straight away, and report it to Report Fraud on 0300 123 2040. (Report Fraud replaced Action Fraud on 4 December 2025. In Scotland, report it to Police Scotland on 101.)
4. Tell the real business, using contact details you already have. If it used our name, we'd like to hear about it.

If someone is pretending to be your business

This is what we'd do again, in this order:

1. Warn your clients the same day. One email each, from your real address, showing what the fake looks like and what to do.
2. Put your contact rules on a page, with every fake listed, and link to it from your emails. Ours is How We Contact You.
3. Report the Gmail account to Google. Google has a form to report abuse from a Gmail account, and it asks for the original email headers, so ask a client to forward you the fake.
4. Forward the fake to report@phishing.gov.uk.
5. Read the NCSC's guidance for businesses being impersonated online: Brand impersonation.

Frequently Asked Questions

Was Brambla hacked?

No. There's no sign that any of our systems were accessed, and our clients' websites weren't touched. The fake emails use public information, such as our names and logo, and send from Gmail addresses.

How do I know an email is really from Brambla?

We only ever email from @brambla.co.uk addresses, usually hello@brambla.co.uk. We never email from Gmail or another free address, and we never ask for urgent payments, domain renewals or bank-detail changes by email. If you're unsure, call us on 020 8050 2803. Our How We Contact You page has the details and every fake we know of.

Where do scammers get the client email addresses?

Agencies who've been targeted say scammers work from public portfolio pages, then take each client's contact email from the client's own website. Nothing private is needed.

What should I do if I've already replied or paid?

If you've paid or shared bank details, call your bank straight away and report it to Report Fraud on 0300 123 2040 (in Scotland, Police Scotland on 101). If you only replied, don't send anything else, and tell the business the email pretended to be from.

Is this the same as email spoofing?

Not quite. Spoofing means faking the sender address so an email appears to come from a real domain. These fakes don't do that: they come from real Gmail accounts set up with names that look like ours. The answer is the same either way: check the full address, and check with the business using details you already have.

Related reading

• How We Contact You
• Website Security Checklist for Small Businesses
• Website Security for Small Businesses: The Complete 2026 Guide
• PHP Security Update: What to Do When a Critical Flaw Hits Your Website (October 2026)