Learning About Myself From Watching My Impersonator

I was in the middle of a two day build. Blinders on, phone on silent, the kind of focus that only happens when I have exactly two days to turn someone's vision into a real website. Then my phone started lighting up anyway. Calls from clients I don't usually hear from out of nowhere.

I switched over to email and found a message from one of my clients, asking if it was really me who had just sent that. It wasn't. Someone had spoofed my Gmail address, scraped my portfolio page for client sites, and emailed a bunch of my clients about a pending fee, using my logo and my business location to make the whole thing look real. It was a convincing setup. And it ended up teaching me something about myself I wasn't expecting to learn.

My first instinct wasn't damage control. It was security. Had someone actually gotten into something? I went straight down my list, checked every login on every piece of software I use, and found my own computer looking back at me every time. Nothing had been accessed. I added a few extra layers of security where it made sense, and within a short window I could tell my real data was safe.

That part came together fast. The part that stuck with me longer had nothing to do with security at all.

The part that actually hurt

Once I knew my systems were clean, what I felt wasn't relief. It was worry that a client would open an email with my name on it and hesitate, even for a second, about whether they could trust me. I've spent years building relationships with the people I work with. The thought that someone could put even a small crack in that, using my own name, bothered me more than any technical fix ever could.

Here's what I didn't expect. My clients caught it almost immediately, and it wasn't because they noticed a fake logo or double checked an address. They had all the right visual pieces in front of them, my branding, my location, enough surface detail to fool plenty of people. What gave it away was that the email didn't sound like me. A few of them wrote back and forth with the scammer just long enough to notice the voice was off, then forwarded me the whole thread. Reading those, I kept noticing how kind people were, even to someone they thought was me asking for something completely out of character. Panicked, but still patient with me. That got me.

It turns out the thing that actually protected everyone wasn't a password or a firewall, and it wasn't the logo or the address either, since the scammer had both of those. It was the fact that my clients know how I actually sound.

What I did next

I sent an email right away to the clients I'm actively working with, since my first fear was that whoever did this had somehow gotten to them before me. Later that evening, once I understood more of what had happened, I followed up with what I believed had gone on and thanked everyone for their patience.

I also used it as a small teaching moment. I've always had a domain email alongside my Gmail, but I'd been using them almost interchangeably. Now I've asked clients to expect emails only from my domain address and to actually notice the signature at the bottom. I've made a few quiet changes on my end too, small things I'm keeping to myself on purpose, since the whole point is that they would be harder for anyone else to copy.

What it taught me about how I work

Once the dust settled, I realized the whole thing had accidentally shown me my own standards by breaking every one of them. I would never send a client a surprise message demanding money with a threat attached. If a big bill is coming, I give you a heads up well before it lands, not an ultimatum out of nowhere.

Getting impersonated is an unsettling thing to go through. But watching someone try to be me, and fail at the one part that actually matters, taught me more about how I show up for clients than I expected. My logo can be copied. My location can be copied. The way I actually treat people apparently cannot.

If you got one of those emails and had a moment of doubt, I don't blame you one bit. The panic is over, my systems are secure, and if anything, I trust the people I work with even more now. I'll be sharing a bit more soon about what you can always count on from me, impersonators aside.