Every small business owner knows the feeling.
A new message comes through your website. The sender says they are a purchasing manager. They represent a company overseas. They have an active project. They need several of your products. They want a quote quickly.
For a moment, it feels exciting.
Maybe this is a major new account. Maybe your website is finally reaching international buyers. Maybe that investment in SEO is paying off.
Then something feels slightly off.
The company name is unfamiliar. The email address is a Gmail account. The message is formal, but oddly generic. The sender claims to need “most of the products and services seen on your website,” yet provides no sizes, quantities, specifications, deadlines, or shipping requirements.
These messages are difficult to identify because they are designed to look like legitimate business inquiries. They are not the obvious spam messages filled with random links, misspelled pharmaceutical names, or promises of instant riches.
They are polished enough to make you hesitate.
That hesitation is exactly what the sender is counting on.
Why These Messages Seem So Convincing
Modern contact-form spam often imitates the language of purchasing departments, procurement managers, contractors, and international distributors.
The sender may include:
- A professional-sounding name
- A company name
- A physical address
- A job title
- A telephone number
- A formal email signature
- A specific country
- A request for a quotation
They may even mention one or more products from your website.
That creates the appearance that someone researched your company and has a genuine need. In reality, much of this information may have been copied from a real company, generated automatically, or assembled from public business directories.
The goal is not always to fool you immediately. The first message may simply be an attempt to start a conversation.
Once you reply, the sender may ask for pricing, payment terms, shipping arrangements, credit, banking information, product samples, or unusual payment accommodations. Some schemes eventually involve fraudulent checks, stolen credit cards, fake purchase orders, overpayments, shipping scams, or malicious attachments.
The original contact-form submission is simply the opening move.
One Suspicious Detail Is Not Always Enough
A Gmail address alone does not prove that an inquiry is fraudulent.
Many legitimate small businesses use Gmail. International phone numbers can look unfamiliar. Buyers sometimes write awkwardly when English is not their first language. A new company may have little online presence.
The key is to look at the full pattern rather than one isolated detail.
For example, imagine receiving two inquiries within a few weeks.
The first sender claims to be a purchasing manager from one Portuguese company. The second claims to represent a completely different Portuguese company. They use different names, different Gmail addresses, different phone numbers, and different business addresses.
At first glance, they appear unrelated.
However, your website records show that both messages came from the exact same IP address.
That is a major warning sign.
Two supposedly unrelated purchasing managers from different companies are unlikely to submit nearly identical inquiries from the same internet connection, especially when the IP address does not match the country they claim to represent.
This is why reviewing the technical information attached to a form submission can be just as important as reading the message itself.
The Biggest Warning Signs
One of the clearest signs is extreme vagueness.
A real buyer usually has questions.
They may ask whether a product is available in a certain diameter, density, color, package size, or material. They may provide estimated quantities, drawings, specifications, delivery locations, or target dates.
A spammer often says something like:
“We are interested in most of the products shown on your website.”
That sounds promising, but it says almost nothing.
Another warning sign is urgency without detail.
The sender may claim that the products are needed “immediately” or request your “best offer without delay.” Yet they still provide no actual order information.
Legitimate procurement can certainly be urgent, but serious buyers usually know what they need.
Watch for contradictions too.
A person may select every product category on your form, then choose “small project amount” as the requested quantity. They may claim to represent a large manufacturing company but communicate only through a generic email address. They may say they previously contacted you even though no earlier submission can be found.
Phone numbers can also reveal inconsistencies. The address may be in Portugal, while the telephone country code belongs to another country. The company name may be real, but the official company website lists completely different contact information.
None of these clues necessarily proves fraud by itself. Together, they form a much stronger case.
Check the Information Before Replying
You do not need to become a cybersecurity investigator every time someone completes your contact form.
A few quick checks can prevent a great deal of trouble.
Start by searching the company name. Look for an official website, a LinkedIn presence, business directory listings, and consistent contact information.
Then compare the sender’s email domain with the company’s official website. A purchasing manager at a well-established manufacturer will often use a company email address rather than an unrelated Gmail account.
Search the phone number and physical address. Make sure the country code matches the stated location. See whether the address actually belongs to the company.
Review the IP address stored with the form submission. Many form tools, including Gravity Forms, record this automatically. An IP lookup can show the approximate country and network associated with the submission.
Also search the exact wording of the message. Spam campaigns frequently reuse the same paragraphs, company names, signatures, and purchasing language across many websites.
Ask a Question a Real Buyer Can Answer
When an inquiry is suspicious but not obviously fraudulent, you do not always have to delete it immediately.
You can respond with a controlled verification question.
For example:
“Please provide the specific product, dimensions, estimated quantity, delivery destination, and required delivery date.”
A legitimate buyer should be able to answer those questions.
A scammer may ignore the request, repeat the original vague message, send an attachment, or immediately ask about payment terms without providing specifications.
You can also ask the sender to reply from their official company email address or provide a link to the company’s website.
Avoid sharing sensitive information during this process. Do not provide banking details, tax documents, credit applications, internal price lists, employee information, or account credentials merely because someone claims to be a purchasing manager.
Improve Your Contact Form
Your website form can help filter these messages before they reach your inbox.
Require buyers to provide:
- The exact product they need
- Estimated quantity
- Intended application
- Delivery city and country
- Desired timeline
- Company website
- Business email address
You can also use CAPTCHA, anti-spam honeypots, IP reputation tools, rate limiting, and country-based filtering when appropriate.
Do not make the form so difficult that real customers abandon it. The objective is to require enough useful information that automated or low-effort spam becomes easier to identify.
It is also helpful to keep form-entry records inside your website rather than relying only on email notifications. The stored entry may contain the IP address, submission time, selected fields, notification history, and other clues that are missing from the email alert.
Trust the Pattern, Not the Presentation
The most important lesson is that professional formatting does not equal legitimacy.
A scam message can include a company name, address, title, and polite closing. It can sound formal and still be fake.
At the same time, an awkwardly written message can come from a perfectly legitimate customer.
Do not judge the inquiry solely by how polished the English sounds. Look at whether the facts make sense together.
Does the company exist?
Does the sender work there?
Does the email address match?
Does the phone number match the country?
Does the IP location make sense?
Did the sender request a real product in a realistic quantity?
Can they answer basic purchasing questions?
Small business owners should remain open to new opportunities, including international inquiries. Just remember that a promising message is not the same thing as a qualified lead.
Slow down, verify the details, and avoid letting urgency push you into sharing information or agreeing to unusual terms.
A real customer will usually appreciate reasonable verification.
A scammer usually will not.