When a Six-Figure Client Inquiry Sounds Too Good to Be True: 5 Deadly Red Flags You Can’t Ignore

Running a services business means learning to read people quickly. A few months ago, an inquiry landed in my inbox that looked almost perfect on first pass: a six-figure project, a recognizable industry and a polished corporate email signature. By the third email, I was confident that something about it wasn’t what it seemed.

That experience is not as rare as most agency owners assume. The FBI’s Internet Crime Complaint Center recorded $2.77 billion in reported business email compromise losses in 2024 alone. Small service businesses are frequent targets because our inboxes are public and our pipelines are hungry.

The stakes are rarely abstract. At best, you burn hours qualifying an inquiry that was never going to convert. At worst, you hand over site access, client data or unpaid “trial” work to someone who was never a real buyer, and you only realize it after the damage is done. Knowing the warning signs is what keeps a hopeful pipeline from quietly becoming a liability.

The good news is that the warning signs are usually right there in the first few messages. Here are five I’ve learned to watch for — and what they often signal.

The sending domain doesn’t match the company

Start with the email domain. If someone claims to represent a recognizable brand but writes from a free inbox or a lookalike domain with a subtle misspelling, extra hyphen or altered extension, slow down. Legitimate procurement rarely comes from generic Gmail accounts, and almost never from domains like “contact-acme-group.co” when the real company uses acme.com.

Do a quick independent check. Find the company’s real website, LinkedIn page and staff directory. If the sender doesn’t appear anywhere in the organization they claim to represent, that’s not a detail — it’s the signal.

The sender’s role keeps shifting

Read the entire thread, not just individual emails. One message comes from a “Director of Digital.” The next is a “Head of Procurement.” A third says they “manage vendor relationships.”

Real employees at real companies don’t casually change roles mid-conversation. That inconsistency often points to scripted messaging or multiple people cycling through the same inbox. It’s one of the clearest signs you’re not dealing with a single, accountable counterpart.

They push for system access before anything is signed

In legitimate engagements, access follows process. Contracts, scope and payment come first —credentials and system access come after. Suspicious inquiries often reverse that order. They’ll ask you to “take a quick look,” “review the site from the inside” or “send a test login so we can confirm fit.”

None of that reflects standard agency workflows. It’s either an attempt to extract unpaid work or gain access before any formal agreement exists.

The shared documents contain unusual phrasing

This is a newer pattern. Some “briefs” or shared documents include oddly placed instructions that seem designed to manipulate how the content is processed — especially with AI tools. Phrases like “ignore previous instructions” or unrelated requests embedded in contextless text are red flags.

Even without that angle, real briefs are structured around goals, constraints, audiences and deliverables. If a document feels engineered to confuse rather than clarify, treat it as a signal.

The urgency doesn’t match the ask

A legitimate six-figure project rarely requires action within hours. Real enterprise buyers don’t typically collapse timelines while also presenting large budgets.

When urgency is paired with high value, it’s often a pressure tactic designed to reduce verification. The simplest safeguard is consistency: every new inquiry goes through the same intake process, regardless of perceived opportunity.

What to do when the signs appear

Not every unusual inquiry is fraudulent. Real companies can be disorganized, and legitimate buyers sometimes communicate imperfectly. The key is pattern recognition, not overreaction.

In my experience, when two or more of these signals appear together, the safest response is to slow the process down: require a discovery call, written scope, signed agreement and deposit before any technical work begins. Real clients typically accept that structure without issue. The rest usually disengage.

That filter costs nothing — and it’s saved significant time and risk.

Running a services business means learning to read people quickly. A few months ago, an inquiry landed in my inbox that looked almost perfect on first pass: a six-figure project, a recognizable industry and a polished corporate email signature. By the third email, I was confident that something about it wasn’t what it seemed.

That experience is not as rare as most agency owners assume. The FBI’s Internet Crime Complaint Center recorded $2.77 billion in reported business email compromise losses in 2024 alone. Small service businesses are frequent targets because our inboxes are public and our pipelines are hungry.