Scams got sophisticated. Here's how I almost got nabbed.

The obvious tells are gone. Two habits still catch it.

A few weeks ago I almost got scammed. HARD.

It came in through the booking form on my site. Budget field: $50,000. Real company, one I could look up, with a real website. The email was polite, well written, and made complete sense.

It came from Brenda, assistant to the Head of Development & Marketing. I replied to start my due diligence.

Her response was friendly and introduced Linda, the team lead, who handles all intro calls through Calendly. "Could you grab a time here?"

So I looked closer at the link.

It was the company's real domain, with /calendly stuck on the end and a long token after it. That's not a thing. Calendly links live on calendly.com. They don't live on your website. It wasn't a lookalike domain and it wasn't misspelled. It was a real address with a fake page hanging off it.

I never clicked, so I can't tell you what was on that page. But a fake page on a real domain has one job: get you to sign in.

So I googled the company, found their main number, and called it. There is no Linda. No Brenda. No project.

The filter I relied on is broken

I'd spent years screening for sloppiness. Typos. Odd grammar. A Gmail address. Manufactured urgency. There wasn't any. The email was better written than most real inbound I get.

That filter is done. Anyone can produce a clean, polite, on-brand email in seconds. The tell has moved. It's no longer in the writing. It's in where the link points and who's actually on the other end.

Two habits. Neither is clever.

Read the URL before you click it. Not the link text. The address itself. Where does it actually go, and does that make sense for what it claims to be? Three seconds. Almost every scam breaks here if you look.

Verify the human on a channel they don't control. If someone emails me, I don't confirm by replying to the email. I look for them on LinkedIn and message them there. If there's no profile, no company, no role that checks out, I call the number on the real website. Real people turn up on the second channel. Brenda didn't. Linda didn't.

If you run a team

Your booking form is a front door. So is every inbox on your team. The person most likely to click is the one you've told to respond to leads fast.

Tell them polish proves nothing now. Make a second-channel check the rule for any inbound that asks someone to log in, pay, or book through a link. And make it clear that slowing down a $50,000 lead by five minutes is the job, not a mistake.

Check the link.
Check the human.
Every time.