This week, we experienced a real email spoofing attempt involving our own CEO. Someone tried to scam one of our clients by copying his photo, his signature, our logo, and even our brand colors — the only thing they got wrong was the email address. We’re sharing exactly what happened, because if it can happen to us, it can happen to anyone in our industry, and to any of our clients.
This is an awareness post, not a sales post. No links to book a call, no package pricing. Just what we saw, why spoofing matters, and how to protect yourself.
What Happened
On July 2, an email landed in a client’s inbox that looked, at first glance, completely legitimate. It appeared to come from our CEO, Jurij Oblak, and included:
- His real name, title, and profile photo
- The WPM logo and brand colors
- A full signature block with (fake) contact details
- A subject line designed to create urgency: “WordPress Website Maintenance & Renewal Notice (Action Required Before July 15)”
The email claimed that plugins, themes, and licenses on the client’s website were about to expire, and that immediate payment of $850 was required to avoid security risks and downtime. It asked the client to approve the charge so an “invoice” could be issued right away.
Everything about it was designed to look official — except the sender’s actual email address. The message came from a free Gmail account made to resemble a WPM address, not from our real domain.
Why This Should Concern Every Business, Not Just Ours
This wasn’t a lazy, typo-filled scam email. Whoever built it took the time to pull a real photo, replicate a real signature, and match real branding. That level of effort is becoming normal, not rare. Any company with a public-facing team — a CEO, an account manager, a support contact — is a target for this kind of impersonation. Your vendors, your agency, your own leadership can all be spoofed the same way.
How to Recognize a Spoofed Email Like This One
A few checks would have caught this one immediately, and they’ll catch most others too:
- Check the actual sender address, not just the display name. A name can say “Jurij Oblak” while the address behind it is a random Gmail account.
- Be suspicious of urgency and deadlines — “action required before July 15” is designed to make you act before you think.
- Be wary of unexpected payment requests, especially ones asking you to simply “approve” a charge by reply.
- Hover over links and check reply-to addresses before clicking or responding.
- When in doubt, contact the person directly through a channel you already trust — not by replying to the email itself.
All Genuine WPM Emails Come From @wpm.si
To make this simple: every legitimate email from our team comes from an @wpm.si address. If you ever receive a message claiming to be from WPM or a member of our team from a Gmail, Outlook, or any other free email provider, treat it as suspicious and reach out to us directly to confirm before taking any action or making any payment.
How to Report a Phishing Email in Gmail
If you receive a spoofed email like this one, reporting it helps improve spam filters for everyone. In Gmail, open the message, click the More (three-dot) icon next to Reply, and select Report phishing. This sends a copy of the email directly to Google’s security team for review.
What We’re Doing About It
We’ve reported the email to Google, flagged it internally across our team, and we’re sending this notice directly to our clients and partners so everyone knows what to watch for. We take this seriously, because trust is the foundation of every project we work on.
If you ever receive an email that claims to be from WPM and something feels off, don’t act on it — contact us directly to verify first. A quick check takes a minute. Cleaning up after a scam takes a lot longer.
