Business Email vs. Gmail: How to Spot a Spoofed Email and Protect Yourself from Phishing
Table of Contents
TL;DR:
A business email address on your own domain ([email protected]) tells customers who you are, a free Gmail address doesn’t. Spoofers know this, which is why they copy a real person’s name and photo, register a lookalike Gmail account, and phish that person’s contacts.
This post covers how to tell a real sender from a fake one, how to check a link before you click it, what to do if you get caught, and how to set up company email, website form delivery, and basic security so you’re harder to impersonate.
Recently, a spoofer pulled our COO’s publicly available information from LinkedIn (image, job role, and company name), grabbed a list of our clients from our portfolio page, and created a generic Gmail account built to look like his. They used his name on a free gmail.com account, and sent emails to our clients who know and trust our COO.
We reported the address to Google, and they shut it down. These attempts to phish however, are a real threat to businesses, as it was built from information that was completely public.
This kind of thing is happening to businesses of every size. Below, we walk through what the scam looked like, why the domain in an email address matters so much, how to check a sender and a link in about ten seconds, what to do if you get caught, and how to set up your own email so you’re harder to copy.
What Actually Happened (+ Why It Worked)
Spoofing and impersonation sound technical, but the method here is simple. Scammers don’t need to “hack” anyone. They read your website, your LinkedIn page, and your team bios, and then they build a believable message from what you’ve already published. A real name, a real job title, and a real client relationship give a fake email just enough credibility to get a reply.
In our case, the sender name matched our COO. A few clients in our circle replied before the address was flagged, and that’s completely understandable. If you get a quick note from someone you work with, your red flags don’t raise instantly, and that’s what these scams count on.
Good people get fooled by well-built fakes every day, including people who work in technology.
The FBI’s Internet Crime Complaint Center reported that business email compromise scams alone cost victims about $2.77 billion in 2024, and total reported cybercrime losses reached roughly $16.6 billion (see the FBI IC3 2024 Internet Crime Report). Impersonating a trusted person is one of the oldest and most effective tricks in that data.
Company Domain Email vs. Gmail
Anyone can open a free Gmail account in about 2 minutes, at no cost, and without proving they have anything to do with your company. Nobody can create an address ending in your company’s domain unless they control it.
For a customer, an address on your own domain says you’re a real, established business. A contractor in Henrico who emails estimates from [email protected] looks smaller and less permanent than one who sends from [email protected], even if the work is identical. A law firm or healthcare practice has an even bigger reason to care, because clients are sharing sensitive case information and need to know who’s on the other end, and that their data is protected.
There is also a technical advantage. When you run email on your own domain, you can publish records (called SPF, DKIM, and DMARC) that tell receiving mail servers which senders are allowed to use your name. A scammer on a lookalike Gmail account can’t pass those checks for your domain, and mail providers get better at blocking spoofs of your real address. Gmail addresses give you none of that control. Your domain also keeps working for you if an employee leaves, because the mailbox belongs to the company and not to a personal account.
The one caveat here is that using a company domain doesn’t make you immune to phishing. Scammers can also register lookalike domains, such as freshmovemedla.com with a lowercase L swapped for an I, and they can still spoof a display name. Which is why the habits in the next section matter just as much as the domain itself.
How to Verify a Sender & Links in 10 Seconds
You don’t need to be a security expert to catch most fakes. Start with the sender. On a phone, tap the sender’s name to see the full address. On a computer, hover over it. Read the domain after the @ sign letter by letter. A message from “Ryan” that comes from a gmail.com address, when Ryan always writes from the company domain, is the first red flag.
Next, think about the request. Does it create urgency, ask for a payment change, ask for gift cards, or ask you to log in through a link? Real colleagues do sometimes ask for things, but they rarely ask you to skip your normal process. When something feels slightly off, confirm it through a second channel. Call the person at a personal number or office line you already have, or send a text or Slack message. Don’t use contact details that came in the suspicious message.
Links deserve their own check. Before you click, hover over the link on a computer, or press and hold on a phone, to preview the real destination. Compare it with the text of the link, because a link that says “Review invoice” can point to a completely different site. Look closely at the domain, which is the part right before the first single slash.
In https://login.yourbank.com.secure-check.net/, the real domain is secure-check.net, not yourbank.com.
When in doubt, skip the link and type the website address yourself or use a bookmark. The Federal Trade Commission has a clear guide on how to recognize and avoid phishing scams that’s worth sharing with your team.
Attachments are the last check. Be wary of unexpected files, especially ones that ask you to enable macros or sign in to view. If a client really did send a document, they won’t mind a quick confirmation call.
What To Do If It Happens to You
First, stop and don’t reply. If you haven’t responded, report the message as phishing in your email app, block the sender, and delete it.
If you’ve responded or clicked, do these immediate things:
- Change the password for any account you typed into a page
- Turn on two-step verification
- Let whoever manages your IT or website know
- If money or banking details were involved, call your bank right away, or cancel your cards
Next, warn the people the scammer is targeting. When we caught the fake Ryan address, we told our clients and contacts that the real Ryan only writes from freshmovemedia.com. A short, friendly heads-up with no blame in it works best, because nobody should feel embarrassed for being targeted.
Then, report the account. We reported the fake address to Google through its Gmail abuse reporting form, and the account was shut down. If you lost money, file a report with the FBI’s Internet Crime Complaint Center and your local police.
Finally, look at what the scammer used. If your team bios, client logos, and staff emails are all on a public page, that’s fine and often good for business, but it helps to know that this information is the raw material.
Is your website contact form landing in spam, or not arriving at all?
Form protection and email delivery are tied together more than most owners realize. Our breakdown of Google’s reCAPTCHA changes shows what to check on your site.
Read More →
Quick Setup Guide: Company Email, Website Forms, & Delivery
If you’re still on a free email address, or your website forms have been unreliable, here’s a practical order of operations. Your web provider or IT contact can do most of it in an afternoon.
Set up business email with Google Workspace:
- Sign up for Google Workspace and enter the domain you already own (yourcompany.com).
- Verify the domain by adding the TXT record Google gives you at your domain registrar or DNS host.
- Add Google’s MX records so mail for your domain is delivered to Workspace, and remove any old MX records.
- Create a mailbox for each person (name@, info@, billing@) and require two-step verification for every account.
- Turn on mail forwarding or migration if you have old mail in Gmail or another provider that you want to keep.
Connect your website forms with SMTP:
- Don’t rely on your web host’s default mail function. It often sends from a server that mail providers don’t trust.
- On a WordPress site, install an SMTP plugin and connect it to your Workspace account (using the secure sign-in option) or to a dedicated sending service.
- Send form notifications from an address on your own domain, such as [email protected], and put the visitor’s email in the Reply-To field instead of the From field.
- Send yourself a test submission after every site update, and check both the inbox and the spam folder.
Keep your email out of spam:
- Publish an SPF record that lists Google (v=spf1 include:_spf.google.com ~all) plus any other service that sends mail for you.
- Turn on DKIM signing in the Google Admin console and publish the key it generates.
- Add a DMARC record as a TXT record named _dmarc at your DNS host. Start in monitoring mode with v=DMARC1; p=none; rua=mailto:[email protected], then tighten the policy once you know every legitimate sender is covered.
- Check your setup with a free tool such as Google Admin Toolbox or Mail-Tester, and read Google’s email sender guidelines if you send newsletters or high volume.
General Safety Habits Worth Building
- Use a password manager so every account has a unique password
- Turn on two-step verification everywhere it’s offered
- Keep your WordPress core, themes, and plugins updated
- Make sure your site runs on HTTPS and that you have automated backups stored
A well-built website is part of this too. Clean code, current software, and secure forms make you a harder target and a more trustworthy business, which is the same thing good website design and a solid SEO foundation depend on. And as more people ask AI tools which businesses to trust, a consistent and verifiable online identity helps there as well, which we cover in our AI search optimization (AISEO) work.
Worried your business is an easy target, or not sure where your email and website stand?
Reach out to our team at FreshMove Media for a free exploratory meeting where we’ll look at your email setup, website, and where you can tighten things up.
Is a Gmail address ever okay for a business?
For a brand new side project, it can work for a few weeks. For anything customer facing, it costs you trust. People can’t tell a legitimate sole proprietor on Gmail from a scammer on Gmail, because anyone can create a free account in two minutes. An address on your own domain proves you control something a scammer can’t easily copy, and it lets you add protections like SPF, DKIM, and DMARC.
How can I tell if an email is really from someone I know?
Look at the full sender address, not just the display name, and check the domain after the @ sign. Then ask whether the request fits how that person normally works. If an email asks for money, gift cards, login codes, or a quick favor, confirm it by calling the person at a number you already have or messaging them on a channel you already use. Never use contact details from the suspicious email itself.
What should I do if I clicked a link or replied to a fake email?
Don’t panic and don’t delete anything yet. Change the password for any account you entered on that page, turn on two-step verification, and tell your IT contact or web provider right away. If money or banking details are involved, call your bank first. Then report the message as phishing in your email app and file a report at ic3.gov if you lost money. Speed matters more than perfect wording.