Recently, we’ve received a number of different requests for website redesign proposals that had some odd and striking similarities, enough to trigger alarm bells that something wasn’t right. What started as a simple text message turned into a call with the Secret Service (yeah, really). We all know how prevalent scams are online, so it’s no surprise that these extend to specifically crafted web design scams, SEO scams and other scams that directly target photographers, designers and other creative professionals. The truth is, we’re all targets. Be alert, trust your instincts and reach out to others in your professional community.
Here’s how the scams work
They’re called the Third Party Payout Scam, the Payment Reversal Scam, the Advanced Fee Scam or the Overpayment Scam. The Fraud Prevention department at credit card payment processor Stripe put it like this:
I can see that you work in web design. Designers such as yourself are common targets for a type of scam known as a Third Party Payout. Essentially, the scammer makes a payment (generally in the thousands) for a project, and pays more than they need so you can then transfer money direct to a third party (e.g. a consultant, graphic designer, etc). I imagine your correspondence with your ‘client’ has been along these line. As I’m sure you’ve figured out, the fix is that the card used is stolen and the third party is actually the scammer. So when the legitimate cardholder disputes the payment the business is left holding the bag on the money retrieved from their account and what they transferred to the scammer.
What’s amazing about these web design scams
- How involved they are – by the time any money were to actually make it back to the scammers, a lot of work and time is devoted to each scam
- How long they’ve been going on for – these scams have been going on for a while, and they don’t look to stop
- The exact scams aren’t changing much – a basic web search will turn up dozens of minor variations on the same web design scams that are being recrafted into seo scams, designer scams and other freelancer scams
- The scammers will email you, text you and sometimes even talk on the phone with you – it’s amazing just how easily a scammer can be totally anonymous hiding behind a throw away webmail account and a Google Voice phone number
Here’s how the web design scams went down
The first scam came through from
Kent Walter <firstname.lastname@example.org> and seemed strange because it mentioned a budget right off the bat (what clients reveal their budget in a blind outreach email) and asked “are you the owner” – strange. It also referenced another website to copy – pretty unusual. Here’s the full email:
From: Kent Walter <email@example.com>
Good I just want to open a new Indian Restaurant i need a website for my business to grow the site should be up & running by ending of March i don’t want a shopping cart in my reservation page also i don’t have a domain name yet i prefer: DHARMAKENTRESTAURANT.COM My budget is $5000-10000 for the web design i need you to go through this example link site: http://www.indikausa.com, i want the same page as this site i want only English language you will be updating the site for me. I have a private project consultant, he has the text content with logo along with the image artwork get back to me with an estimate including hosting i will like to know if you are the owner or the manager?
This person is the scammer: “I have a private project consultant, he has the text content with logo along with the image artwork”
“Kent” even sent through a sitemap drawing of the website he wanted to make – pretty funny in retrospect. And since this time, the website http://www.indikausa.com has been suspended by HostGator. I emailed with “Kent Walker” a few times until I realized the whole thing was going nowhere – he never responded to basic discovery questions. I didn’t suspect this was a web design scam. Until a few weeks went by.
The second web design scam came through a few weeks later – early in the morning as a text message from someone claiming to be
Luis Lee at (732) 893-0731. The first text read “good day are you available for a website design.” Our business number accepts text messages and our Google My Business listing allows potential customers to text message us. Here’s where the alarm bells start going off:
From Luis Lee (732) 893-0731
am luis i would love to know if you can handle website design for a new company and also if you do accept credit cards ?? kindly get back to me with your email so i can send you the job details.
And it gets even more fishy when the email came through from
luis lee <firstname.lastname@example.org>
From: luis lee <email@example.com>
I have small scale business which i want to turn into large scale business now it located in TX and the company is based on importing and exporting of Agriculture products such as Kola Nut, Gacillia Nut and Cocoa so i need a best of the best layout design for it. Can you handle that for me ?. so i need you to check out this site but i need something more perfect than this if its possible .http://www.agroamerica.com…. the site would only be informational, so i need you to give me an estimate based on the site i gave you to check out, the estimate should include hosting and i want the same page as the site i gave you to check out and i have a private project consultant, he has the text content and the logos for the site.
1. I want the same number of pages with the example site i gave you to check excluding videos and blogs.
2. I want only English language
3. I don’t have a domain yet but i want the domain name as leetopfarmproduce.com
4. you will be updating the site for me.
5. i will be provideing the images, logos and content for the site.
6. i want the site up and running before ending of next month.
7. My budget is $4000 to $6000
Kindly get back to me with:
(1) an estimate
(2) And will like to know if you are the owner ??
This person is the scammer: “i have a private project consultant, he has the text content and the logos for the site”
I immediately thought, “There is that same email we received from the Indian Restaurant a few weeks ago. What are the odds.” It became obvious pretty quick that both were web design scams.
But then my brain quickly went to “how do these web design scams work? – how do they play out – what kind of people are doing this?” I have no intentions in vigilante justice. Or intentions of repeating the amazing journey of phone scam discovery that took the producers of the Reply All podcast to India to meet the people behind those annoying junk calls from a phone number a few digits off from your own (episodes one and two – will blow your mind).
Curiosity got the best of this cat, so I played along with the web design scam to find out more.
Luis of course eagerly responded to my proposal
I emailed with “Luis Lee” a few times and even made up a quick proposal based on the sitemap of the Agro America website and sent it off to Luis. I even called him to see if he would pick up. I ended up talking to Luis on the phone, though the connection was terrible and neither of us could understand each other. He did, though, email me right back to accept my proposal.
From: luis lee <firstname.lastname@example.org>
Thanks for your response, I am okay with the estimate everything sound good and i’m ready to make payment now with my credit card, I understand the content for this site would be needed so work can start asap but i will need a Little favor from you and the favor is that I will send you my credit card to charge for the sum of $5850 plus 3% Cc company charges, You will deduct $2750 as deposit for the design of the website plus extra $100.00 as a tip for handling perfect work for me and you will send the remaining $3,000 to the project consultant that has the text content and the logo for my website so once he receive the $3,000 he would send the text content and logo needed for my website to you so work can start asap,Sending of funds would be after money clears into your account and You will be charging my card for remaining balance upon completion of work, Kindly get back to me so we can proceed with payment asap
Here’s the scam: “you will send the remaining $3,000 to the project consultant that has the text content and the logo for my website”
Pretty good location for a gacillia nut business
I asked for a name and address of the company, and was given the kind of uncreative name “Luis Lee LTD” and the address 5603 Peacock Ridge San Antonio, TX 78228. As if more evidence of this web design scam were needed, a quick search on that address showed that it had been listed for sale just 21 hours ago.
I reached out to Stripe to see if they had any interest in at least tracking an IP address from these people. I can turn my credit card payment processor into testing mode so charges aren’t really processed. The great people at Stripe’s Fraud Prevention department told me to do absolutely nothing like that, to stop all communications and to reach out to the Secret Service with details of the web design scam.
It turns out this particular variant on the Third Party Payout Scam / Payment Reversal Scam / Advanced Fee Scam / Overpayment Scam has its own name: the Agro America Scam and the Gacillia Nut Scam. Unlike the Indian Restaurant variant where the example website seems to have been suspended, it seems that Agro America is a legitimate business and doesn’t play a part in this scam. The website did send my computer’s CPUs through the roof, making me wonder about BitCoin / cryptocurrency mining. But enough about the scam.
What to do if you’ve been targeted
- Unless any money has been stolen from you, the best thing to do is nothing. Delete the emails / texts and never reply at all. It’s unlikely that the scammers are sitting in a room together and will put you on some kind of organized hey don’t contact this web designer again, she’s onto us type list. More likely is that the scammers are an unconnected group of people using the same scam, are totally disorganized and will probably contact you again. So just delete. We played along for a bit to find out more about the scam out of curiosity, but it’s probably not a good idea.
- If you want to report the scam, or have unfortunately lost any money, you can reach out to
- The Secret Service – we were referred to them by Stripe even though no money had changed hands. The Secret Service is responsible for counterfeiting law violations as well as financial fraud including banking, access device, advance fee fraud and computer fraud, financial document counterfeiting, and money laundering. I had a pretty nice chat on the phone with a Secret Service agent who confirmed how widespread these web design scams are and told me that unless money had changed hands, they weren’t too interested in trying to track anyone down
- FBI Internet Crime Complaint Center (IC3) – complaints filed via this website are processed and may be referred to federal, state, local or international law enforcement or regulatory agencies for possible investigation
- Federal Trade Commission Complaint Assistant