If I had gone through with it, I could have lost a great deal. I am seeing more and more attempts to scam digital agencies, and the social engineering behind them is genuinely clever.
Why agencies are the target
The attack works because it aims at something every agency has: demand for new clients. An email arrives that looks completely legitimate. There is a website, apparently under construction, that looks like a solid project. They claim they have done their research and want a meeting to discuss an RFQ.
That framing disarms you. You are not evaluating a stranger’s link, you are responding to a promising lead, and the part of your brain that would normally be suspicious is busy being pleased.
The mechanics of the link
The link points at Zoom, a platform everyone trusts. The tell is what sits around it. The email mixes Calendly and Zoom inside the same link, and adds a line saying if the link does not work, use this different one. That second link is the point of the whole email.
Where it actually takes you is a quickly built page hosted on a generic app platform, which then forwards you onward to something designed to look exactly like a legitimate booking page. By then you have clicked twice and stopped reading the address bar.
Two habits defend against this: read the destination, not the label, and treat any “if this link fails, try this one” as a red flag rather than helpfulness. The same instinct that catches the security problems nobody wants to hear about applies to your own inbox.
Security is a habit, not a product
Agencies tell clients to take security seriously and then click things at speed because a lead came in. The discipline has to run both ways. It is the same argument as the client who ignored a security audit and why some problems cannot wait once something does get through.
If you want a security review of your store and your process before something forces one, book a call.