This month, someone started sending email impersonation scams to our clients using the name of Randy Looper, founder of Carolina Creative Group. The emails carried his photo, his signature, and our company name. They came from Gmail accounts we do not own.
Several clients spotted the problem right away and called us. That instinct is the best defense there is. This post explains what happened, how these scams work, and the steps that protect your business and your customers.
What Happened at Carolina Creative Group
Scammers created Gmail accounts with names that look like ours, including randy.carolinecreativegroup@gmail.com and contact.carolinacreativegroup@gmail.com. They emailed our clients about a “WordPress security update” or a “website compliance and renewal notice.” When a client replied, they followed up with a fake audit, priced packages, and an invoice.
None of these emails came from us. They came from outside accounts, not from our email systems. Instead, the scammers built their messages from public information: a name, a headshot, a website, and a LinkedIn profile.
The pattern we saw ran in three steps:
- First email: An urgent subject line about security or compliance, asking you to reply “PROCEED.”
- Second email: A fake website performance audit with a low score to create concern.
- Third email: Two or three maintenance packages, then an invoice with bank details that belong to no one at our company.
In short, the goal is to get a client to pay before anyone checks.
How Email Impersonation Scams Work
Email impersonation scams borrow a trusted name to make a payment request feel routine. The scammer does not need to hack anyone. They set up a lookalike address, copy a real signature, and write to people who already trust that business. The request almost always ends with money, gift cards, or a login.
As a result, the losses are large. The FBI’s 2025 Internet Crime Report logged 24,768 business email compromise complaints and more than $3 billion in reported losses. The FTC reported that people lost $3.5 billion to imposter scams in 2025, with nearly $1 billion tied to business impersonation.
Small businesses make easy targets for email impersonation scams for one reason. Their clients know the owner by name, and that familiarity lowers their guard. For example, a message that sounds like someone you have worked with for years rarely feels like a threat.
Warning Signs of a Fake Business Email
Most fake business emails share a few traits. First, they come from a free email account instead of the company’s own domain. Next, the message creates urgency around security or a deadline. It also asks you to reply instead of call. Finally, it moves quickly toward a payment, often to an account you have never used.
- A free email address: Gmail, Outlook.com, or Yahoo. Established businesses send from their own domain.
- A small misspelling: “caroline” instead of “carolina.” Read the address letter by letter.
- Manufactured urgency: Phrases like “Action Required,” “Renewal Notice,” or “Compliance Deadline.”
- Work you never discussed: Services or prices that never came up in a real conversation.
- New payment details: A bank account in a personal name, or any change to how you normally pay.
- Reply-only contact: No phone number, or a number that does not match the one you already have.
How to Protect Your Business From Email Impersonation Scams
Protection comes down to one habit: verify before you pay. Confirm any unexpected request through a channel you already trust, such as the phone number on a past invoice. After that, add technical controls so scammers have a harder time sending email that looks like it came from your domain.
Verify every payment request by phone
The FBI recommends confirming significant payments with a second step outside of email. Also, look up the phone number yourself instead of using one in the message. A two-minute call stops most of these scams cold.
Set a written rule for payment changes
Decide that no change to bank details takes effect without a call to a known contact. Then write it down and share it with everyone who pays bills. That way, a written rule removes the pressure to make a judgment call in the moment.
Forward instead of replying
If an email seems off, do not hit reply. Instead, start a new message to the address already saved in your contacts. Otherwise, your reply goes straight back to the scammer.
Lock down your domain against business email compromise
Three DNS records, called SPF, DKIM, and DMARC, tell receiving mail servers which systems may send email for your domain. The FTC recommends email authentication for small businesses for exactly this reason. These records will not stop someone using a free Gmail account. However, they do stop scammers from forging your real domain, which is the more convincing attack.
Turn on multi-factor authentication
Multi-factor authentication protects your real email, hosting, and banking accounts from takeover. As a result, even if a password leaks, an attacker still needs the second code from your phone.
Train your team
Anyone who handles invoices, vendor emails, or client payments should know how email impersonation scams look. After all, a short conversation at your next staff meeting costs nothing and closes the most common gap.
What to Do If You Receive an Email Impersonation Scam
If one of these emails reached you, do not reply, click, or pay. If money already moved, call your bank immediately and ask them to stop or recall the transfer. After that, file a report with the FBI and the FTC. Acting fast gives your bank the best chance of recovering the funds.
- Stop: Do not reply, open attachments, or send payment.
- Call your bank: If you paid, ask them to freeze or recall the transfer right away.
- Report it: File with the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov.
- Flag the sender: Report the Gmail account to Google through its Gmail abuse form, and mark the message as phishing.
- Tell the real business: Forward the email to the company being impersonated so they can warn others.
How Carolina Creative Group Communicates With Clients
Carolina Creative Group only sends email from our own domains, carolinacreativegroup.com and carolinamediagroup.com. We never send email from Gmail. We do not send unsolicited invoices or ask you to approve paid work by email, and our payment details have not changed. If something feels off, call us at (864) 255-9270 before you act.
We posted a notice on our homepage and contacted clients directly. Above all, thank you to everyone who flagged these messages. Your quick calls helped us respond the same day.
If you want help setting up SPF, DKIM, and DMARC on your own domain, contact our team. We can review your current setup and show you where the gaps are.
Frequently Asked Questions
Did these fake business emails come from Carolina Creative Group?
No. Every message we have seen came from outside Gmail accounts using Randy Looper’s name and public details. Real email from us ends in carolinacreativegroup.com or carolinamediagroup.com.
Can SPF, DKIM, and DMARC stop email impersonation scams?
Partly. They block forged email sent from your actual domain. They cannot stop a scammer who opens a free account with a similar name. For this reason, the verify-by-phone habit matters most.
Where do I report an email impersonation scam?
Report it to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov. If the sender used Gmail, report the account to Google as well. If you lost money, call your bank first.
