AI-written contact form spam: what it looks like, how to spot it

Four patterns that show up in almost every machine-written sales approach, the three things a real enquiry does that none of them manage, and what to do when one lands in your form.

An AI SDR — "sales development representative", automated — is a tool that finds businesses, writes each one a personalised message, and sends it. The personalisation is real: it reads your site. What it cannot do is want anything from you specifically.

That gap shows up in the writing, consistently enough to describe.

What these tools are

The category is not a secret, and the vendors describe it plainly on their own product pages. 11x says its AI SDR, Alice, will "research prospect signals across social, public, and engagement data", engage buyers "across email, calls and more", and "book you meetings on autopilot". AiSDR says its product "reads their recent posts, checks company news, looks at what's happening in their industry" before writing, and describes the messages as "100% written by AI".

We name them only because their own pages confirm what the category does, not as a recommendation either way. The workflow is the same across most of them: pick a target list, gather public information about each business, generate a message that references it, send, follow up, and try to get a meeting in the calendar.

Most of that goes out by email. Some of it comes through your website instead. Services built specifically for contact forms advertise that they find the form, fill every field, generate a unique message per target site and submit it, and tell their customers why: "There's no spam folder for contact forms." Which is why this post is about your contact form as much as your inbox.

The four patterns

Each of these follows from the workflow rather than from any one tool. The software knows what is public about you and nothing about what you need. It is judged on meetings booked, not on replies that say something. And it has to work across thousands of recipients at once, so anything specific has to come from you, because nothing specific can come from the sender. Put those three constraints together and the same message shape falls out, whoever wrote the prompt.

It opens by admiring you. A compliment about your work in the first sentence, and the noun in that compliment was scraped from your homepage or your most recent post. Real enquiries rarely open with praise, because the person writing has a problem and wants it solved.

A typical opening looks like this (an illustrative composite, as are all the examples here):

Loved your recent post on moving to cloud accounting — it's clear your team really understands what growing firms need.

The post exists. The sentiment does not. Nothing after that sentence refers to it again.

Its credential is unverifiable. "We help businesses like yours" — no client name, no case, no number that could be checked. When a figure does appear it is a multiple ("3x more enquiries") rather than an amount, because a multiple cannot be wrong.

We've helped practices like yours see up to 3x more qualified leads in under 90 days.

"Practices like yours", "up to", "qualified". Every word is doing the job of avoiding a claim.

It asks for time, not an answer. Fifteen minutes, a quick call, a short chat. Nothing in the message can be replied to, because there is no question in it. A booking link usually follows.

Would you be open to a quick 15-minute call next Tuesday or Wednesday? Here's my calendar if easier.

It describes a business it has not understood. The message would read the same if it had been sent to a dental practice. This is the strongest tell and the hardest to put into a rule: the words are all about you, and the substance is about nobody.

A useful test is to swap the scraped noun. Replace "cantilevered oak staircase" with "composite fillings" and see whether the rest of the message still works. If it does, it was not written to you.

What a real enquiry does

Three things, and almost every genuine message does at least two.

It contains a detail only the sender could supply. A dimension, a date, a delivery number, the name of a project, the address of a building. Something that came from their situation rather than from your website.

It asks something answerable. A price, a lead time, availability, whether you work in a particular material. There is a reply that would satisfy it.

It is inconvenient to write. Genuine enquiries are often too long, badly paragraphed, missing context, or slightly rude. Machine-written mail is rarely any of those, because a model producing outreach at volume has no reason to be careless.

For contrast, a genuine enquiry often looks like this:

hi we're converting a barn near Hexham, need a staircase roughly 2.6m floor to floor, open riser if possible. can you do oak and what sort of lead time are we looking at, builder wants it in by end of March. thanks

No compliment, no credential, a number, a place, a deadline and two questions. It took someone five minutes they did not really have.

That last signal is worth sitting with. The messages that look most professional in the mail from a contact form are, increasingly, the ones nobody sent.

Signal	Machine-written approach	Real enquiry
Opening	Praise for something on your site	Straight to the problem
Specifics	About you, taken from your site	About them, from their situation
Evidence	Multiples, "businesses like yours"	Measurements, dates, places
The ask	Time: a call, a demo	An answer: a price, a date, a yes or no
Finish	Polished, evenly paragraphed	Uneven, sometimes abrupt

None of these is proof on its own. Together they are hard to fake, because faking them means knowing something about the sender's own situation, and there isn't one.

Is it even allowed?

People ask this, so here is the context — not legal advice, and worth confirming with your own adviser if it matters to you.

In the UK, the rules on marketing by electronic mail sit in PECR. The ICO explains that the PECR rule on email marketing "doesn't apply to corporate subscribers" — companies, LLPs and similar bodies — so B2B marketing emails to them do not need consent under PECR, although the sender must not conceal their identity and must give a valid address for opting out. Sole traders and some partnerships are treated as individuals, and can only be sent marketing email if they have consented or the "soft opt-in" for existing customers applies. The UK GDPR still applies whenever a named person's data is used, even in a business context. The ICO notes that this guidance is under review following the Data (Use and Access) Act.

In the EU, Article 13 of the ePrivacy Directive says email for direct marketing "may be allowed only in respect of subscribers or users who have given their prior consent", with an exception for existing customers. That consent rule applies to subscribers who are natural persons; for businesses, the directive leaves it to each member state to ensure their interests are "sufficiently protected", so the position for business recipients depends on the country.

Contact forms are a grey area. The ICO describes electronic mail as covering emails, texts, social media direct messages and "any similar message that is stored electronically", but that guidance does not specifically mention a message typed into a website form. Do not assume a pitch through your form is either clearly lawful or clearly unlawful.

Reply or ignore?

Most of the time, ignore. There is no question in the message, so there is nothing you owe it.

If it is a pitch you do not want: delete it. You do not need to click the booking link to find out what it was.
If the same sender keeps coming back: a one-line reply asking to be removed is reasonable. The ICO says senders should comply with a business's opt-out request, and a legitimate firm will.
If it might actually be useful: reply with one specific question the sender could only answer if a person is reading. "Which of our projects did you look at, and what would you change?" A real salesperson answers. A sequence sends follow-up number two.
If it asks you to open a file, log in or pay something urgently: that is no longer outreach. See the most common kinds of contact form spam.

If several people share the form's inbox, agree on this once rather than message by message. The expensive version of this problem is not one person answering a sequence; it is three people each spending ten minutes deciding whether the same pitch deserves a reply, while the barn conversion sits unread underneath it.

The hard cases

Not everything divides cleanly. These are unsolicited, often templated, and frequently genuine.

Press and production companies. A researcher for a television programme looking for a joinery workshop reads exactly like a pitch: flattering, general, asking for a call.

Trade accounts and suppliers. A timber merchant offering an account is selling something. It may also be the best offer you get this year.

Recruiters with an actual vacancy. Templated, yes. Pointless, not necessarily.

Real customers using AI to write. A person may ask a chatbot to turn their notes into a tidy paragraph before sending. The prose goes smooth, but the barn in Hexham and the March deadline survive. The specifics are still the thing to look for.

A filter that holds these back is as expensive as one that lets the sales pitches through — false positives cost more than people expect.

The honest answer is that those should be surfaced rather than decided: shown to a person with the reasoning attached, so the judgement stays where the consequences are. That is how uncertain messages are handled in Humainbox: the message is shown for review with a written reason, rather than quietly held.