Five Ways Your 'Contact Us' Page Quietly Invites Fraud — and How to Shut Them Before December

Picture a two-person outfit in Shrewsbury that makes engraved gifts. It does fine all year. Then the second week of November arrives, enquiries triple, and among the genuine ones sits a message asking for a bulk order, quoting a delivery address, and requesting a pro-forma invoice on letterhead. It gets answered at 9pm by someone tired. That's the moment these scams are built for.

The contact page is the least glamorous part of any small website, and at this time of year it's the most exposed. Here's what to look at, in the order that gives you the most protection per hour spent.

Fix one: decide what the form is actually for

Most enquiry forms ask for six fields because six fields looked tidy. Trim it. Name, email, and what they need is usually enough for a first contact. Every extra field — phone, company, address, budget — is data you now have to look after, and in some cases a reason a fake enquiry looks convincing.

If you need a separate route for trade orders, build it. Mixing retail enquiries and wholesale paperwork in one inbox is how spoofed invoices slip through unnoticed.

Fix two: basic form hygiene

The warning signs on your own site are easy to test. Submit your own form and see what happens next. Does it bounce straight back to your personal address, revealing it in the headers? Does it accept a link in the message body? Does it let the sender fill in their own subject line?

• Add a CAPTCHA or a honeypot field. Free, five minutes, kills most automated junk.
• Rate-limit submissions, or use a form handler that does it for you.
• Keep the destination inbox private. Use a form service or a contact@ alias rather than exposing the address your accountant emails.
• Strip links from the message body, or at least don't turn them into clickable links in the notification you receive.

Fix three: get your email authentication in order

This is the one that stops spoofed invoices arriving in your customers' inboxes wearing your name. Three records in your domain's DNS settings do the job: SPF, which lists who may send mail as you; DKIM, which signs your outgoing mail; and DMARC, which tells receiving servers what to do when something fails those checks.

Plenty of UK micro-firms have SPF but no DMARC, or DMARC set to monitor-only and never tightened. Start at monitor, read a week of reports, then move to quarantine once you're confident your own mail — including your website's form notifications and any booking tool — is passing. The NCSC publishes a free checker, and most domain registrars now walk you through it.

While you're in there, register the obvious lookalike domains if they're cheap, and turn on two-factor authentication on the mailbox itself. An email account is the master key to everything else.

Fix four: rewrite the auto-reply

Automatic replies are a gift to a fraudster. They confirm the address is live, they leak staff names, they sometimes list opening hours and the fact that the boss is away until the 27th.

Keep it short and neutral: a reference number, an expectation of when you'll reply, and one deliberate line — we will never contact you to change our bank details. Put the same sentence in your email signature and on the invoices you send out. It sounds heavy-handed until the day a customer rings to check.

Avoid auto-replies on any mailbox that handles orders. If you must have one, make sure it doesn't confirm anything about an order the sender mentioned.

Fix five: make the last mile human

Technology won't catch a well-written fake order. Process will.

1. Any request to change bank details, on any account, gets a callback on a number you already had — never one supplied in the message.
2. Payments above a threshold you set get two pairs of eyes, even if that means your business partner looks at it on a Sunday.
3. Send invoices as a PDF from a system, not as an editable document, and never accept an amended version back.
4. Brief whoever covers the inbox over Christmas on the three scams that actually land: fake bulk orders, fake supplier invoices, and replies that hijack a genuine thread.

That last one is worth dwelling on. A convincing variant takes a real enquiry you've already answered, replies to it from a lookalike address, and changes one detail — the account number or the delivery address. It reads perfectly because most of it is yours. A call-back rule defeats it entirely.

A forty-minute version

If you only do one thing today, do the form test and the auto-reply rewrite. If you have an afternoon, add DMARC and a call-back rule for bank detail changes. Neither requires a budget, and both will still be protecting you in February when the enquiries dry up and the discipline usually goes with them.

Small firms don't get targeted because they're interesting. They get targeted because the door is open and nobody's watching it in December. Close it now, while there's still time to be smug about it.