loader image

Anatomy of a fake client enquiry (featuring an inflatable giraffe)

Posted on by William
Robert Wilson's first reply, annotated. Highlighted: he is the "Lead Digital Strategist, representing the business owners", wants a custom e-commerce platform for "aggressive business scaling", is "not scheduling calls at this preliminary stage", won't share a brief, budget or timeline, and wants "your detailed thoughts". His mobile is +44 7700 900531. Red flag notes beside each, and one saying 07700 900 numbers are reserved by Ofcom for TV dramas.

On 2nd November, 2026, an enquiry landed through our contact form from a “Robert Wilson”. He wanted a garden website rebuilt on one of the big e-commerce platforms. A proper project, an online shop, room to grow. On paper it was a dream lead, and I’ll admit I did a small happy dance around the studio.

The normal questions

I replied with what I ask everyone: who’s behind the business, what the site needs to do, and roughly what budget and timeline they have in mind. Nothing nosy, just the basics we need before we can quote honestly.

Robert came back the same evening. That’s his reply in the picture at the top of this post (open it full size), and the further I read, the more red flags went up:

  • A grand job title, but no names. Not one person I could look up, including him.
  • Big buzzwords, no real detail. It read like a brochure for a company that doesn’t exist.
  • He wouldn’t take a call. Email only, thanks.
  • No budget and no timeline. For a project he was very excited about.
  • He wanted my “detailed thoughts”. For free, before any of the above.
  • His mobile was +44 7700 900531. Ofcom keeps that range aside for TV and radio dramas, so nobody gets a call meant for a fictional detective. Real people don’t have those numbers. Soap characters do.

So we tested him

By now I was fairly sure I was talking to a bot, or to someone pasting my emails into one. So I did what any responsible web designer would do, and sent back the most ridiculous pitch I could write with a straight face.

Our reply, annotated: solid gold servers that are faster because gold is heavier and falls through the internet more quickly, a life-size inflatable giraffe holding a trowel, a checkout made of compressed moss, paying by humming at the screen, and a newsletter delivered by trained pigeons plus an AI hedge that greets every visitor by name. A note asks whether a bot will agree to literally anything.

My proposal included:

  • Solid gold servers, which are faster because gold falls through the internet quicker.
  • A life-size inflatable giraffe holding a trowel.
  • A checkout made of compressed moss.
  • Paying by humming at the screen.
  • A newsletter delivered by trained pigeons, and an AI hedge that greets visitors by name.

A real business owner would either laugh or quietly block me. Either would have been a perfectly good result.

Eight days later

Robert was back. He put the silence down to his son being in hospital, which is exactly the kind of sob story that’s hard to question, and that’s rather the point. Then he got down to business. The giraffe was “intriguing”. We had “passed our preliminary technical screening”. And there was now a $60,000 budget on the table, “including the procurement of solid gold servers and pigeon training”.

Robert's reply eight days later, annotated: his son was in hospital, the inflatable giraffe with a trowel is "intriguing", we have "passed our preliminary technical screening", and the budget "including the procurement of solid gold servers and pigeon training" is $60,000. The last line asks us to book through a "corporate calendar" link, circled in red with the note: a fake Calendly on a lookalike domain, don't click.

Lovely. But then came the real point of the whole exchange. Would I book a call through his “corporate calendar”? The link went to a fake Calendly page on a lookalike web address that borrows the WP Engine name, a well-known web host, to look official. Pages like that are almost certainly there to steal a login or slip some malware onto your computer. The flattery, the budget and eight days of patience were all just to get me to click.

What we did

We didn’t click it. I reported the email to Google with Gmail’s “Report phishing” button, and sent the details to WP Engine’s abuse team so they can go after whoever is borrowing their name. No call, no giraffe, no harm done.

What to take from it

If you run a small business, here’s the short version:

  • A real client will talk to you. If someone with a big project won’t pick up the phone or hop on a video call, ask yourself why.
  • Generic wording, a free email address and no names are warning signs. A real business usually writes from its own domain and tells you who you’re dealing with.
  • Look up odd phone numbers. A quick search told me this one belonged in a TV drama.
  • Never book a meeting through a link from an unverified stranger. Offer your own booking link or a phone call instead.
  • If in doubt, send them something ridiculous and see if they agree. A real person will ask if you’re feeling all right. A bot will tell you the giraffe is intriguing.

And if a weird enquiry lands in your inbox and you’re not sure what to make of it, send it our way. We’re happy to take a look, and we promise not to quote you for the pigeons.