# Phishing warning email templates for staff and customers

You've found a domain that looks like yours, say `examp1e.com` or
`example-invoices.com`, and it has mail servers set up. Before you know
whether it has been used, the people most likely to be fooled should hear
about it from you. A short, specific warning works better than a general
reminder to "watch out for phishing".

Send it as soon as you've confirmed the domain isn't yours, while you
work on getting it taken down: see
[report a lookalike domain](/guides/report-lookalike-domain-takedown).

## What makes a warning work

- **Name the domain exactly**, written so it can't be clicked:
  `examp1e[.]com`. People can match a name; they can't act on "a suspicious
  domain".
- **Show the difference** next to your real domain.
- **Say what the scam will ask for**: changed bank details, a password,
  a gift card, an urgent payment.
- **Give one action**: forward it to a named address, or call a number
  they already have.
- **Don't attach screenshots of the fake site** with live links, and don't
  write the domain as a link.
- **Keep it short.** Three paragraphs get read; a page of advice doesn't.

## Template: staff

```
Subject: Warning: fake emails from examp1e[.]com

Someone has registered examp1e[.]com, a copy of our domain with the
letter "l" replaced by the number "1". It is not ours.

  Real:  example.com
  Fake:  examp1e[.]com

It may be used to send emails that look like they come from a colleague,
a manager or finance, asking you to pay an invoice, change bank details,
buy gift cards or sign in to a "shared document".

If you get an email from this domain, or anything that looks like it:
don't reply, click or open attachments. Forward it to
security@example.com and delete it. If you already replied or entered a
password, tell IT straight away on +1 555 0100. You won't be in trouble.

Thanks,
[Name], IT
```

## Template: customers and suppliers

Send this from your normal address to the people who pay you or whom you
pay. Keep it calm: the message is that you're on top of it.

```
Subject: Please check: emails from examp1e[.]com are not from us

Hello,

We've found a website and email address, examp1e[.]com, set up to look
like ours. It is not connected to Example Ltd. Our emails only ever come
from @example.com.

Our bank details have not changed. If you ever receive a request to pay
us at new bank details, please call us on the number you already have
for us before paying, not a number given in the email.

If you've received anything from examp1e[.]com, please forward it to
security@example.com. Thank you for your help.

[Name]
Example Ltd
```

Don't put a phone number in this message that you haven't already given
customers elsewhere: telling people to trust only numbers they already
know is the point.

## Template: short notice for your website or invoices

```
Example Ltd only sends email from @example.com. We will never ask you to
pay into new bank details by email. If in doubt, call us on the number
on our website.
```

This belongs on invoices, your contact page and your email signature
whether or not there is an active scam.

## After you send it

1. **Ask your mail admin to block the domain** at the gateway (Microsoft
   365 Tenant Allow/Block List, Google Workspace blocked senders), so mail
   from it doesn't reach staff at all.
2. **Report it** to the registrar and, if it has a site, the host:
   [GoDaddy](/guides/report-phishing-domain-godaddy),
   [Namecheap](/guides/report-phishing-domain-namecheap),
   [Cloudflare](/guides/report-phishing-domain-cloudflare).
3. **Lock down your own domain** so scammers can't spoof the real one:
   move DMARC to enforcement with
   [DMARC from none to reject](/guides/dmarc-none-to-reject).
4. **Send a short all-clear** once the domain is taken down, so people
   don't stay on alert forever and start ignoring warnings.

If mail has already gone out in your name, see
[someone is pretending to be my company](/guides/someone-is-pretending-to-be-my-company).

## Find lookalikes before they're used

The [lookalike domain checker](/tools/lookalike-domain-checker) lists
registered domains that look like yours and shows which ones can send
email. Nameward's monitoring checks again every 6 hours and alerts you
when a new one that can send email appears, so the warning goes out
before the first fake invoice does.

---
Source: https://nameward.app/guides/lookalike-domain-warning-email-template (updated 2026-10-31)