You've found a domain that looks like yours, say examp1e.com or
example-invoices.com, and it has mail servers set up. Before you know
whether it has been used, the people most likely to be fooled should hear
about it from you. A short, specific warning works better than a general
reminder to "watch out for phishing".
Send it as soon as you've confirmed the domain isn't yours, while you work on getting it taken down: see report a lookalike domain.
What makes a warning work
- Name the domain exactly, written so it can't be clicked:
examp1e[.]com. People can match a name; they can't act on "a suspicious domain". - Show the difference next to your real domain.
- Say what the scam will ask for: changed bank details, a password, a gift card, an urgent payment.
- Give one action: forward it to a named address, or call a number they already have.
- Don't attach screenshots of the fake site with live links, and don't write the domain as a link.
- Keep it short. Three paragraphs get read; a page of advice doesn't.
Template: staff
Subject: Warning: fake emails from examp1e[.]com
Someone has registered examp1e[.]com, a copy of our domain with the
letter "l" replaced by the number "1". It is not ours.
Real: example.com
Fake: examp1e[.]com
It may be used to send emails that look like they come from a colleague,
a manager or finance, asking you to pay an invoice, change bank details,
buy gift cards or sign in to a "shared document".
If you get an email from this domain, or anything that looks like it:
don't reply, click or open attachments. Forward it to
[email protected] and delete it. If you already replied or entered a
password, tell IT straight away on +1 555 0100. You won't be in trouble.
Thanks,
[Name], IT
Template: customers and suppliers
Send this from your normal address to the people who pay you or whom you pay. Keep it calm: the message is that you're on top of it.
Subject: Please check: emails from examp1e[.]com are not from us
Hello,
We've found a website and email address, examp1e[.]com, set up to look
like ours. It is not connected to Example Ltd. Our emails only ever come
from @example.com.
Our bank details have not changed. If you ever receive a request to pay
us at new bank details, please call us on the number you already have
for us before paying, not a number given in the email.
If you've received anything from examp1e[.]com, please forward it to
[email protected]. Thank you for your help.
[Name]
Example Ltd
Don't put a phone number in this message that you haven't already given customers elsewhere: telling people to trust only numbers they already know is the point.
Template: short notice for your website or invoices
Example Ltd only sends email from @example.com. We will never ask you to
pay into new bank details by email. If in doubt, call us on the number
on our website.
This belongs on invoices, your contact page and your email signature whether or not there is an active scam.
After you send it
- Ask your mail admin to block the domain at the gateway (Microsoft 365 Tenant Allow/Block List, Google Workspace blocked senders), so mail from it doesn't reach staff at all.
- Report it to the registrar and, if it has a site, the host: GoDaddy, Namecheap, Cloudflare.
- Lock down your own domain so scammers can't spoof the real one: move DMARC to enforcement with DMARC from none to reject.
- Send a short all-clear once the domain is taken down, so people don't stay on alert forever and start ignoring warnings.
If mail has already gone out in your name, see someone is pretending to be my company.
Find lookalikes before they're used
The lookalike domain checker lists registered domains that look like yours and shows which ones can send email. Nameward's monitoring checks again every 6 hours and alerts you when a new one that can send email appears, so the warning goes out before the first fake invoice does.