Why Are You Getting Plain, Harmless-Looking Emails from Strangers?
Those plain, harmless-looking emails from strangers are usually the opening move of a social engineering scam. They carry no link and no attachment, so nothing trips your spam filter. The sender wants one thing back from you: a reply. Your reply confirms the address is real and starts the con.
The reply is what the scammer is really after
The first email is harmless on purpose. There is nothing to click and nothing to download, so it reads like a genuine, if slightly odd, message. You have probably seen more of these lately. A promising business lead, someone claiming you have spoken before, or a simple PDF that looks like an invoice you forgot to pay.
Reply once, and the scammer learns your address is active and watched. Now the friendly back-and-forth can begin. Over days or weeks they build a little trust. Then they send the real trap: a link to a fake sign-in page, or a malicious file dressed up as a proposal. By then your guard is down.
This is hard to spot, and you are not alone in finding it so. The UK's National Cyber Security Centre says some phishing emails will get past even the most observant users. Attackers target people as much as software. Verizon's 2026 Data Breach Investigations Report puts the human element behind 62 per cent of breaches.
How does this email scam actually work?
It works in stages, and each stage looks innocent on its own. The scammer sends a harmless message, waits for your reply, builds trust through normal conversation, then strikes once you feel comfortable. That patience is what makes the whole thing effective.
The first email is bait. It might mention an opportunity, a document, or a chat you do not remember having. Reply, and you have confirmed a live target. The scammer then talks normally for a while to lower your guard. Only later comes the request that costs you money or access.
In business, this often ends in business email compromise. A criminal poses as a supplier, team member, or manager and attempts to redirect a payment. The ICO describes business email compromise as social engineering used to move funds to the wrong account. We explained how criminals redirect team member payments in a separate guide.
Why do these emails get past spam filters?
They get past filters because there is nothing harmful to detect. Spam and security tools look for dangerous links, malware, and known scam patterns. A short, plain email with none of those things looks like ordinary mail, so it lands in your inbox like any other message.
Most email protection is built to catch a payload. Take the payload away, and you take away the thing the filter is trained to spot. The scammer trades a low success rate for clean delivery. They send these in bulk, and a few replies make it worth their time.
What is Email Check by Kimbley IT?
Email Check is a free service from Kimbley IT that tells you whether a suspicious email is genuine or a scam. Kimbley IT is a UK managed IT services provider and Google Cloud Partner. You forward the email, and Kai, our AI, replies within a few minutes. You get a plain explanation and clear steps for what to do next. It costs Kimbley IT clients nothing extra.
You do not need to be technical to use it. If an email is unexpected, feels odd, or makes you think twice before responding, that is reason enough to forward it. Kai reads it, checks it against the signs of a scam, and comes back quickly. If you are already a Kimbley IT client, you have the forwarding address. If you are not, this is one of the things you get when you join.
How to tell a genuine first email from a scam opener
| Genuine Email vs Scam Opener | ||
| What to check | Genuine business email | Scam-opener email |
|---|---|---|
| Links and attachments | May include a relevant link or file | None, which is how it slips past filters |
| The ask | A clear, specific reason for contact | Vague, and mostly wants you to reply |
| Your shared history | References something real you can check | Claims a past chat you do not recall |
| Urgency | Rare in a genuine first message | Often hints you should act soon |
| Sender detail | Real name, company, and role you can verify | Generic greeting and thin sender detail |
What should you do when an email feels off?
When an email feels off, do not reply, do not click, and do not open attachments. Check the sender through a channel you already trust, report it, and forward it to Email Check for a quick verdict. A few careful minutes now beats weeks of cleanup later.
Do not reply, click, or open attachments. A reply tells the scammer your address is active and invites the next stage.
Verify the sender through a channel you already trust. Call the person or company on a number you have from your own records. For payment requests, a simple codeword adds another check.
Forward it to Email Check. Kimbley IT clients can send any suspicious email to Kai and get a clear answer in minutes.
Report it in Gmail. Use the built-in report option so Google can block similar messages. Here is how to report a phishing or spoofed email in Gmail.
Report it nationally. Forward scam emails to the UK reporting address at [email protected].
Frequently asked questions
-
On their own, usually not. The first email tends to carry no link or attachment, so opening it does little harm. The risk starts the moment you reply. A reply confirms your address is active and gives the scammer the opening they want, so silence is the safest response.
-
Normal spam wants a click or a sale straight away. These emails want a conversation first. The scammer sends something dull and harmless, waits for your reply, then builds trust before asking for anything. The wait is what makes them harder to spot than everyday spam.
-
Business email compromise is a scam that abuses a trusted business relationship. A criminal poses as a supplier, a team member, or a manager to trick you into moving money or sharing details. It often starts with the friendly, low-key emails described here. The real request arrives once you trust the sender.
-
No. Email Check is included for Kimbley IT clients at no extra cost. You forward a suspicious email, Kai checks it, and you get a clear answer within a few minutes. There is no catch and no usage trap, because the point is to keep you safe.
-
Yes. Any email you forward to Email Check is handled securely and used only to check for scams. Your information is never shared outside the Kimbley IT support team. You can forward something sensitive and know where it ends up.
Book a call
If you want help making your business email safer day-to-day, book a video call with Kimbley IT using the form below. You will see how Email Check fits in and where your inbox could be better protected.
