Last updated: 14 August 2026
Someone is pretending to be me and emailing our clients fake invoices.
This page explains what the emails look like, how to tell them apart from our real billing, and what to do if one lands in your inbox.
If you have received one of these emails, please do not pay it and do not click any links inside it. Email me directly at [email protected], or message me on WhatsApp, and I will confirm either way. We would much rather answer a dozen quick questions than have one client out of pocket.
What is going on
Since the start of August 2026 we have had reports from several clients, past and present, of emails signed off in my name asking them to pay for scheduled website maintenance.
They are convincing. The person behind them has copied my photo, my job title, our office address and our phone number into the email signature, and they have a rough idea of how a web agency bills.
In at least one case they kept a normal back and forth conversation going over several days before the money was requested, and answered questions along the way.
The money does not come to us. It has never come to us.
The email addresses being used
Every fake email we have seen so far has come from a free Gmail account:
- [email protected]
- [email protected] (note the misspelling of Peter)
All of our billing comes from @slinky.au, and nowhere else. We do not use Gmail, Outlook, Hotmail or any other free account for invoices, and we never have. If you see @gmail.com after my name, it is not me. That single check will catch every version of this scam we have come across.
What the fake emails say
The wording changes slightly between clients, but the pattern is the same:
Common subject lines
- Time to Schedule Your Website Maintenance
- New WordPress Updates
Common claims
- A new WordPress release is out and your site needs core, theme and plugin updates
- The work has to be done before a set date, with 17 August mentioned in several emails
- A flat fee of $750, or $600 in other versions, sometimes quoted in USD
- A long list of inclusions: malware scanning, backup checks, database cleanup, speed and caching work, licence renewals
The list of services reads well because it is a fair description of real maintenance work. That is what makes it work as a hook.
How they ask for payment
Payment links have pointed at Stripe, Payoneer and Revolut. In one case the Revolut link was under the name Jenny S. A client who paid through Payoneer saw the funds go to a name none of us recognise, and the receipt came back under a third name again.
Pressure after the fact
One client received a follow up asking them not to lodge a chargeback or payment dispute, saying the work was already underway. Another was told the payment link was about to expire and a fresh invoice could be sent straight away. Both are worth knowing about, because that is the point where people usually start to have doubts and the scammer is trying to talk them out of acting on it.
How to tell a real invoice from a fake one
| Genuine Slinky billing | The fake emails | |
| Sender address | @slinky.au | A free Gmail account |
| Currency | AUD, as always | USD in some emails, AUD in others |
| Payment method | The bank details or payment method already set up on your account | New Stripe, Payoneer or Revolut links sent by email |
| Payee name | Our registered business name | Personal names with no connection to us |
| Timing | Your usual billing cycle | Out of the blue, with a deadline attached |
Two things are worth holding on to. We will never email you a brand new payment link out of nowhere, and we will never ask you to pay by a method you have not used with us before. If either of those happens, stop and check with us first.
What to do if you receive one
- Do not pay it and do not click the links.
- Do not reply to the email. A reply confirms your address is live and tends to bring more of them.
- Forward it to us so we can add it to the record, then delete it.
- Let anyone else in your business who handles invoices know. This one matters more than it sounds. If an invoice gets passed along internally with a note to pay it, the person paying has no way of judging whether it was real, because the checking already appeared to have happened. Check the sender address before you forward it, not after.
If you want to be certain an invoice from us is real, email me at [email protected] or send me a WhatsApp message. Please do not use any contact details printed in the suspicious email itself, since the fakes carry real looking ones.
If you have already paid
Move quickly, because the first few hours matter more than anything else you can do.
- Contact your bank or card provider straight away, tell them the payment was fraudulent and ask about a recall or chargeback. Do this before anything else.
- Report it through the payment platform itself. Stripe, Payoneer and Revolut all have fraud reporting channels and they can act on the receiving account.
- Report it to Scamwatch at scamwatch.gov.au and to ReportCyber at cyber.gov.au. Both feed into the same picture, and the more reports there are against these accounts, the faster they get closed.
- Tell us. We are keeping a record of every address, link and payee name involved, and each new detail helps.
What we are doing about it
We have reported the Gmail accounts to Google and the payment links to the platforms hosting them. We have contacted every client we bill directly. We are also keeping a running record of the addresses and payee names being used, which is what this page is for.
The frustrating part is that shutting down a Gmail account takes a few minutes to replace. So the practical protection is not on the enforcement side, it is the habit of checking the sender address before anyone pays anything.
Any questions
If something has landed in your inbox and you are not sure about it, send it through to [email protected] or message me on WhatsApp. There is no such thing as a silly question here, and I would far rather look at ten legitimate invoices than miss a fake one.
Peter Brittain
Slinky Digital
[email protected]
