If you’re a freelance web developer or designer, you’re going to get this email eventually. I got it today. Here’s the whole script, broken down, so you can spot it in about ten seconds instead of ten emails.
How it starts
A cold email lands in your inbox from someone claiming to need a contract web developer for a client. No mention of your name, your site, your portfolio — nothing that suggests they actually looked you up. Just a mass-blast opener like “I hope this meets you well,” followed by a list of requirements:
- Reside in the US
- Provide an invoice for work done
- Proficient with HTML/CSS, UI/UX, JavaScript
That requirements list looks like due diligence. It isn’t. It’s a filter. Every item on it exists to confirm one thing: that you’re a US-based freelancer who can legally accept a check and cash it. Nothing on that list actually screens for skill.
The sender in my case signed as “Barry Moser” — which, if you google it, turns out to be the name of an actual, well-known wood engraver and illustrator from Tennessee. That’s not a coincidence. Scammers often borrow the name of a real, semi-notable person because it survives a quick Google search without immediately reading as fake. The real Barry Moser almost certainly has no idea his name is being used this way.
The “job details” email
Once you reply expressing interest, you get a second email with the “project.” Mine described a small agricultural import/export business (kola nut, cocoa — oddly specific, oddly irrelevant) wanting an informational website. It included a competitor’s site as a reference and a long list of very particular requirements: exact page count, English only, a specific domain name already picked out, a project consultant and social media manager who would supposedly provide all the text and images.
None of that is really about the website. It’s set dressing. The email is long and detailed enough to feel like a real client brief, which is exactly the point — it lowers your guard for what comes at the very end.
Small thing worth flagging: I googled “gacillia nut,” one of the products this supposed business imports, out of curiosity. Every single result that came back was tied to scam reports. It’s not a real product — it’s a made-up or misspelled term that shows up specifically in this kind of email. If you ever get a similar pitch and something in the product or business description sounds slightly off, a quick search on that specific term can out the whole thing fast.
The actual ask
Buried after all the project details, the email asks for:
- An estimate
- Your cell phone number
- Your city
- Whether you’re the principal of your business
- Whether you accept checks
That last question is the entire scam. Everything before it — the fake client, the fake consultant, the page count, the domain name — exists to get you comfortable enough to answer “yes” to that one line without thinking twice.
Why the check question is the whole thing
Here’s the part that catches people, even careful people: a check “clearing” is not the same thing as a check being confirmed real.
When you deposit a check, your bank gives you provisional credit almost immediately. It looks exactly like real money sitting in your account. But that’s not the check clearing — that’s your bank fronting you funds while the check physically travels back to the sender’s bank for verification. That trip can take days, sometimes weeks, especially if the sender’s bank is out of state or overseas-adjacent.
Somewhere in that window, you’ll typically get a message with an urgent reason to wire money back — “my assistant sent too much, please wire the difference to our equipment vendor,” or something similar. If you wire that money, it’s real money, gone immediately. Then, days later, the original check bounces as fraudulent. Your bank reverses the provisional credit. You’re out whatever you wired, and now you also owe your bank the reversed amount if you’d already spent against it.
The scam only works because of that gap between “looks cleared” and “actually cleared.” By the time the check is confirmed fake, the real money you wired back is long gone.
The tells, all in one place
- Generic opener, no personalization
- Anonymous email provider (mine used Proton Mail)
- A borrowed name that belongs to a real, semi-public person
- Vague client with no company name or actual website
- A suspiciously specific budget ($3,000–$5,000) offered before any negotiation
- Mention of a “consultant” or “team” who’ll supply content, none of whom you’ll ever hear from again
- The check question, always placed last, always framed as a minor detail
What to actually do
- Don’t reply further once you spot the pattern
- Don’t give out your phone number, city, or an estimate
- Never accept a check where you’re expected to refund any part of it, ever, for any reason
- Report the account to the email provider’s abuse team (abuse@proton.me for Proton)
- Report to IC3 (ic3.gov) under “Cyber-Enabled Frauds, Scams, or Cyber Threats and Intrusion,” or to the FTC at reportfraud.ftc.gov
This exact script runs on freelancers constantly, usually with minor variation on the industry and the borrowed name. If you’re getting client leads cold, it’s worth having this checklist in your back pocket before you ever open your invoicing software.