The contact form spam you get most, and how to recognise each

SEO offers, "errors on your website", guest posts, fake invoices, legal threats: a field guide to the contact form spam you keep getting, the tell for each, and what a real one looks like.

Most contact form spam is not random. The same dozen pitches reach a joinery workshop, a dental practice and a firm of accountants, reworded each time, and once you have seen each type a few times you can place it from the first line. The difficult part is the small number of messages that look like one of these types and are not.

This is a field guide. For each type there is a typical message (a composite written for this post, not a real one), the tell, and what a genuine version of the same thing would contain.

Offers to fix your visibility

SEO and "page one of Google". A typical message looks like this:

Hi, I was checking your website and noticed it is not ranking for several important keywords in your area. We can get you on the first page of Google within 90 days. Can I send you a free audit?

The tell is a promise with no keyword named. Google's own guidance on hiring an SEO is blunt about both halves: "No one can guarantee a #1 ranking on Google", and "Be wary of SEO firms and web consultants or agencies that email you out of the blue." The same page quotes one Google itself receives: "Dear google.com, I visited your website and noticed that you are not listed in most of the major search engines and directories..."

A genuine version comes from an agency you approached or were referred to, and it names the searches you currently lose and who wins them.

Redesigns, "outdated" sites and "I found errors".

Hello, I noticed a few errors on your website that are costing you customers, including some broken elements and mobile display issues. I have put together a short report. Shall I send it over?

The tell is that the errors are never listed. The report exists only after you reply, because your reply is what is being collected. Someone who has actually found a broken page tells you which page, since it costs them nothing to do so.

A genuine version is a customer telling you the booking button does nothing on their phone, and saying which page they were on.

Offers to run part of the business for you

Software and app development outsourcing.

Hi team, we are a development company with 10+ years of experience in web and mobile apps. We help businesses like yours cut development costs by up to 60%. Do you have any upcoming projects we could support?

The tell is that it asks whether you have a project rather than responding to one, and the credential cannot be checked: no client, no baseline for the percentage. It is the pattern described in what AI-written contact form spam looks like. A genuine version refers to something you published: a tender, a job advert, a post asking for quotes.

Lead generation and appointment setting.

I help construction companies book 10 to 15 qualified sales meetings a month without cold calling. Open to a quick 15-minute call this week?

The tell is that it asks for your time rather than an answer, and the industry in the first line is the only part written for you. It is, of course, cold outreach offering to spare you cold outreach.

Recruitment and "partnership" pitches.

We would love to explore a strategic partnership with your company. We work with leading brands in your space and see strong alignment. Who is the best person to speak to?

The tell is a partnership with no proposal in it. "Who is the best person to speak to" is a request for a name and a direct email address, which is worth more to a list-builder than anything you could say. The recruitment version offers candidates for roles you have not advertised. A genuine version names a specific arrangement, such as a referral agreement or a joint bid for a named contract, with enough detail that you could turn it down.

Partnership overtures are also used for worse. Check Point Research described a 2025 campaign that began through targets' "Contact Us" forms, with the attackers posing as a potential business partner and asking for a non-disclosure agreement before delivering malware.

Business funding and loan offers.

Your business has been pre-approved for up to £250,000 in working capital. No collateral, funds in 24 hours. Reply YES to see your options.

The tell is approval without an application. Nobody has assessed anything, because nobody knows anything about you beyond a web address. A lender you have actually applied to contacts you through the details you gave it, not through your website's form.

Requests for your links

Guest posts and link insertions.

Hi, I really enjoyed your article on energy efficiency. I would like to contribute a high-quality guest post to your blog, free of charge, with one do-follow link in the author bio. Alternatively we can pay for a link in one of your existing posts.

The tell is that the interest is in the link, not your readers. "Do-follow" gives it away. These messages exist because links affect search rankings, and Google's spam policies name the trade directly: "Buying or selling links for ranking purposes" is link spam, including "Exchanging money for links, or posts that contain links", as are "links with optimized anchor text in articles, guest posts, or press releases distributed on other sites." Google says paid links are acceptable when marked with rel="nofollow" or rel="sponsored", which is precisely the marking these requests want left off. The same page warns that "Sites that violate our policies may rank lower in results or not appear in results at all", so the site taking the money carries some of the risk.

A genuine version comes from someone who writes in your field, proposes a topic your readers would want, and does not mention link attributes at all.

Messages that want payment, or want you frightened

Fake invoices and "payment pending".

Please find attached invoice INV-20931 for your annual directory listing. Payment is now overdue. To avoid suspension of your listing, settle today using the secure link below.

The tell is a service you do not recognise, a deadline, and payment by link. The US Federal Trade Commission's May 2026 alert describes fake invoices for "tech support, domain registration, or search engine optimization services", some arriving with a "past due" notice, and warns that some emailed invoices are "really a phishing scam designed to get access to your business's data and networks." The UK's National Cyber Security Centre gives the same warning: criminals "may send an invoice that looks real but contains a virus, or ask you to pay money into a different bank account."

There is also a simpler question: why would an invoice come through your contact form? A supplier you have an account with sends invoices to the accounts address it already holds, against something you ordered. If in doubt, ring them on a number you already have, not one in the message.

Legal, copyright and data-protection complaints.

Your website is using my photographs without permission. This is a copyright violation and I will begin legal action within 48 hours. The images and my proof are here: [link]

The tell is a legal consequence, a short deadline and a link to "evidence", instead of naming the image and the page it appears on. This is the one type on this list regularly used to deliver malware, which is why it has its own post. Do not open the link.

The data-protection variant threatens a complaint to the regulator and attaches a "report". Be careful with this one, because a real request about someone's personal data can legitimately arrive through your form. The UK Information Commissioner's Office says a person "can make a SAR verbally or in writing, including by social media. They can make it to any part of your organisation". A genuine request asks for the person's own information and says who they are. It does not need you to download anything.

The hard category: unsolicited and real

Everything above is easy compared with this. A journalist asking for comment by Thursday. A wholesaler's new rep introducing a product range. A job applicant sending a speculative CV. A student doing research for a dissertation. All unsolicited, often templated, sometimes selling something, and every one of them occasionally worth more than the rest of the month's messages.

The hardest version is a real supplier using a template: a mail-merged introduction that reads exactly like the software outsourcing pitch, except the company exists, sells something you buy, and would give you a trade account if you asked.

What separates these from spam is not tone, it is reference. The journalist names a publication and a deadline. The rep names a product line you could plausibly stock. The applicant names a role, or at least your trade. None of those details can be generated from your homepage alone, but a rule cannot tell that either. Messages in this category should be seen by a person, not decided by a filter.

Questions to ask of any message

When a message does not obviously fit a type, these do most of the work:

Does it contain a detail only the sender could supply? A date, a quantity, an address, a product, a reference number. Something from their situation rather than from your website.
Does it ask something you could answer? A price, availability, a lead time. Spam asks for time, a name, or a click.
Would it read the same sent to a different business? Swap your company name for a florist's. If nothing else needs to change, nobody wrote it to you.
Does it want you to click, download or pay before it tells you anything? Real correspondents put the substance in the message.
Can you check it through a channel you already have? A supplier's known number, the publication's own website, your own records.

Type	What it wants	The tell	A real one includes
SEO offer	A call or an audit request	Guarantees, no keyword named	The searches you lose and to whom
"Errors on your site"	A reply	Errors never listed	The page and what broke
Development outsourcing	A project	Asks if you have one	Your tender or advert
Lead generation	Fifteen minutes	No question in it	Rarely comes via a form at all
Partnership or recruitment	A contact name	No actual proposal	A specific arrangement or role
Funding offer	A "YES"	Pre-approved without applying	An application you made
Guest post or link	A followed link	Link attributes mentioned	A topic for your readers
Invoice	Payment by link	Unknown service, deadline	Your purchase order, known supplier
Legal or data complaint	A download	Deadline and "evidence" link	The specific work or data concerned

Why there is more of it, and why it reads better

Two costs collapsed. Writing a personalised pitch used to take a person several minutes per business, which kept volume down and quality low. A language model now writes one for almost nothing, and it reads your homepage first, so the compliment in the opening line contains a real noun from your site.

Finding forms and filling them in is also automatable. Contact forms are public by design, and Microsoft's 2021 research into contact form abuse noted that the attackers "may have used a tool that automates this process while circumventing CAPTCHA protections."

The result is that polish no longer tells you anything. Spelling and absurdity were the old tells, and they have gone. What is left is the substance, which is why the questions above are about what a message says rather than how it looks. Why your spam filter seems to have stopped working covers the same shift from the filter's side.

If you would rather not sort these by hand, Humainbox reads each message and records why it was held or delivered; messages it is unsure about, such as the hard category above, can be shown to you with that reason instead of being silently dropped. How it works explains the settings.