What My Impersonator Got Wrong About How I Actually Work

If you read my last post, you know someone spoofed my email and tried to pass themselves off as me to my own clients. I've already told you what that taught me about trust. What I haven't told you yet is what the actual content of those fake emails revealed, because whoever wrote them did a surprisingly good job of demonstrating everything I don't do.

The surprise bill

The fake email demanded payment with a threat attached, something along the lines of pay up or your site comes down. I understand why that landed as believable enough for a moment. Bills are stressful, and a lot of small business owners have been burned by a vendor who springs a number on them out of nowhere.

That is not how I work. If a bill is coming, you hear about it before it lands, not as an ultimatum. I know what an unanticipated expense can do to a small business, because I run one myself. You should never have to brace yourself when you see my name in your inbox.

The plugin problem

Here's the detail that actually got under my skin a little. The scam email claimed the client's site needed new plugins installed. That is such a common line for a reason, plugin-based platforms create an ongoing stream of little installs and updates, and that stream is exactly where a message like this can hide.

I don't build that way. I build on platforms that have proven themselves and don't depend on a patchwork of plugins to function. In 2026, I genuinely don't see the point of a website held together by a dozen third party add-ons when the platforms I use do the job on their own. It is not just a preference, it is one less door for something like this to sneak through.

When something actually does need to change

None of this means your site is frozen in time. Businesses grow and sites need real updates sometimes. When that happens, here is what actually occurs. I flag it, I quote it, and I wait for your go ahead before I touch anything. You are never billed for a change you didn't already agree to, and you are never told about it after the fact.

What the contrast made clear

It is a strange thing to watch someone impersonate you and, in doing so, hand you a list of everything you would never do. No surprise threats. No plugin-dependent builds that create constant little vulnerabilities. No changes without a heads up and a real number attached. My logo and my location were easy enough to copy. Apparently the way I actually treat the people I work with was not.

If anything ever shows up in your inbox that feels off, threatening, or out of character for me, trust that instinct. It probably is.