Spammers and Scammers: The Personalized Pitch

Welcome to Spammers and Scammers, our second edition in this new series where we explore different scams targeting our indie author and publisher community so we can stay educated and protected from bad actors in our community.

Last month, we spoke about the new challenges ALLi's Watchdog Desk is facing this year with (the rise and rise of AI scams!) and ran through the basic red flags every author should know: vague pricing, guaranteed bestseller promises, high-pressure tactics, victim retargeting. If you missed it you can take a look here.

This month we're tackling the personalized pitch: how to spot it, how to avoid it, and how to protect your author business.

Why This Is Getting Worse

ALLi's Watchdog Desk has fielded reports of personalised scams from members since its inception ten years ago, so that's nothing new. But over the last year, we've watched the sophistication rise sharply. Emails that would have been easy to spot even twelve months ago are now detailed, personal, and convincing enough to make a careful author stop and ask, “wait, is this real?”

Industry researchers tracking phishing attacks recorded a genuinely startling shift at the end of last year. In one detailed analysis, AI-generated scams accounted for a small fraction of all detected phishing attacks in November, then jumped to well over half of all detected phishing attacks the following month. A roughly fourteen-fold increase in a matter of weeks.

Researchers at IBM found that a convincing, well-targeted scam email now takes an AI tool about five minutes to write. The same email, built by hand the traditional way, used to take an experienced scammer around sixteen hours, researching the target, drafting, refining.

Impersonating a person or a brand used to take skill and patience. Now it takes a name, a book title, and a free AI tool. As indie publishers, it's more important than ever that we're armed with the right knowledge to protect ourselves, and our indie author businesses.

Email's Still the Wild West, But Help Is Coming

Before we go further into the detail, we wanted to offer a word of reassurance upfront. Some developments in email protection are on the horizon and that should hopefully help (we didn't want to leave this section until the end of the piece, to avoid burying the positives).

At the time of writing, in 2026, anyone can send an email claiming to be almost anyone. There's no ID check at the sending end, and a display name is trivially easy to fake, although the email address itself is not, and we'll come back to that shortly.

Before you despair, there is real progress being made. You'll likely recognise the shape of it already: verified checkmarks have become almost universal across the major social media platforms, and email tech companies are now adopting the same method. Gmail, Yahoo, and Apple Mail have started showing a blue verified checkmark next to senders who've properly authenticated their domain, a system that confirms the email is genuinely coming from the brand it claims to. Google's own stated aim is to help people tell legitimate senders apart from impersonators at a glance.

It's a genuine step forward, but adoption is still patchy. Plenty of small, entirely legitimate services don't have it yet, since it requires real technical setup on the sender's side. So the absence of a checkmark doesn't prove a scam. But if you do see one, on Amazon, on a publisher, on any organization, that's a good sign.

Until this becomes standard, the burden is still on us to check. So let's get into how.

What These Scams Are Really Selling

Unlike many other scams out there which target distraction or carelessness, the personalized pitch is a particularly nasty type of phishing scam targeting writers, indie publishers (and other creatives in neighbouring industries). It's built to target something deeper: hope. The dream of the call, the email, the moment someone finally sees what you've made.

We believe that's a distinction worth sitting with for a moment, as it changes what we're actually guarding against. It's the very thing that got you writing in the first place, and we have to stay alert to that being used against us (without letting it curdle into suspicion of every good thing that comes our way, of course).

Before we continue, it's worth mentioning: nobody who's been caught out, or nearly caught out, by one of these should feel foolish. In this instance these scammers are not usually lone individuals but teams of criminal professionals whose sole job is to deceive.

So let's look at three real examples, sent to ALLi members recently. On the surface they look different: a celebrity endorsement, a trusted organization getting in touch, an offer to adapt your book for the screen. But underneath, they're the same scam wearing different guises, all built around a personalized pitch that flatters you and promises something you want. A different kind of scam entirely might look like your bank account being locked, or your book being taken down; that's not what this piece is about. It's worth saying phishing emails come in far more shapes than any one piece can cover (we'll look at more in coming editions of Spammers and Scammers), but for now, here are three real examples of the personalized-pitch scam, in the guises we're seeing most right now.

Example #1: The Celebrity Endorsement

What to notice:

• The sending address is a free Gmail account, not an official domain. A real Reese's Book Club selection would never arrive this way.
• No book title, no ISBN, nothing that proves anyone actually read your work. “Your work stood out” could be sent to anyone.
• The ask is tiny on purpose: just reply “Interested.” That single word is the hook. Everything else, and any payment request, comes after you've already engaged.

The Trusted Organization

The name of this one might be familiar because it's someone pretending to be us! The Alliance of Independent Authors, and Sacha, one of our team.

Please note: Sacha Black is a real person, and this email goes on to describe the recipient's book in accurate, specific detail, right down to its themes and structure (we have removed this for privacy reasons). That's not a guess. Someone, or more likely something, trawled the book's page before writing this.

What to notice:

• Look at the address again: [email protected]. That is a free Gmail account, dressed up to look like a domain at a glance. It is not one. ALLi and our team will only ever write to you from an address ending in @allianceindependentauthors.org. If you're ever unsure whether something claiming to be from us is genuine, write to [email protected] and we'll tell you straight away.
• Borrowing a real name and a real, trusted organization at once is a more convincing move than either alone. If it can happen with us, it can happen with any organization or advisor you trust.

The Screen Deal

What to notice:

• As with all the others, the sending domain was primevideoscreenplays.com, a lookalike registered to sound official. Legitimate Amazon communications only ever come from an @amazon.com address.
• The compliment is generic (“your writing reflects great potential”), the opportunity is enormous (a Prime Video series), and the gap between the two should be the first thing that gives you pause.
• The financial ask is upfront and dressed as a discount. No legitimate studio ever charges you to develop your own manuscript into their show. Real deals pay the author, not the other way round.
• Same low-friction ask as the others: reply “Yes” and a “representative” takes it from there.

The Pattern

Looking back at all three, a clear pattern emerges. An email arrives, either from an organization you recognise or with the promise of something that feels almost too good to be true: a lucrative deal, a moment of recognition, an offer that gets your hopes up. It knows details about you and your book, and it seems genuinely interested in getting to know you. The first step is usually always a quick reply.

What You Can Do

• Avoid replying immediately, even out of curiosity. A reply confirms your address is live and being read.
• Check the actual sending domain, not just the display name.
• Search independently for the person or organization plus the word “scam.”
• Verify directly with the organization being named, using contact details you find yourself, not ones in the email.
• If you are an ALLi member you can contact the support desk as part of our member resources.

One More Thing

We've also heard reports of emails claiming a partnership or endorsement from ALLi and giving out inaccurate information about how our services ratings actually work. If you're unsure, you can always check with us directly before taking their word for it. Email [email protected] and we'll confirm or deny within a day, usually much sooner.

Before You Go

This series exists because you're the first line of defense, and because the more of these you see, the faster you'll spot the next one. If you've received a pitch that felt a little too perfect, forward it to us, or just let us know in the comments. Please note it's the scam email itself we'd feature (anonymized), never any of your own details.