Phishing Alert: Fake Bid/Proposals Emails

emails disguised as legitimate invitations

Fri 31st Jul, 2026

By APA Admin

⚠️ PHISHING ALERT

Fake Bid/Proposal Emails Targeting Photographers

A phishing campaign is currently targeting photographers with emails disguised as legitimate project invitations — something like “You’re invited to submit a proposal for an upcoming commercial shoot or editorial project.”

These emails use photographers’ real names, email addresses, signatures, logos, and letterhead to look authentic. Many begin with “Good morning” or “Good afternoon,” though wording varies.

IMPORTANT: the “real” sender address can mean two different things —

The sender’s account was compromised and the attacker is sending directly from it, or
The sender’s address was spoofed (faked in the “from” field) without the attacker ever having access to that account.

These require different responses — see below.

TWO ATTACK METHODS TO WATCH FOR

Credential phishing: A link leads to a fake login page (sometimes hosted on a legitimate platform like Google Sites or SharePoint to avoid raising suspicion). Entering your credentials there hands the scammer real-time access to your email.
Malware attachment: A link or a compressed/zip file, when opened, silently installs malware that can capture keystrokes and credentials.

HOW TO SPOT IT

Any request to log in again to view a proposal or document you weren’t expecting — this is the single most reliable red flag, more than the link itself.
Generic or slightly-off details: misspelled names, vague project descriptions, a signature or tone that doesn’t match how that person usually writes.
Check the actual sender address, not just the display name — does it match a domain that person has used with you before?
Hovering over links can help but isn’t foolproof, since some landing pages are hosted on legitimate platforms.

BEFORE RESPONDING TO ANY UNSOLICITED BID/PROPOSAL EMAIL

Verify the sender through a separate, trusted channel — call or text them, don’t reply to the email itself.
Don’t click links or open attachments, especially zipped files.
Report it as phishing to your email provider, then delete it.
Report it to APA Membership Rep, membershiprep@apanational.org so we can track how widespread this is.

IF YOU CLICKED THE LINK, OPENED AN ATTACHMENT, OR ENTERED CREDENTIALS

If you downloaded or opened a file, disconnect from the internet and run a malware scan before doing anything else.
Change your email password immediately, from a different, trusted device.
If that password was reused anywhere else, change it there too, and check haveibeenpwned.com (http://haveibeenpwned.com) for that email address.
Enable two-factor authentication if it isn’t already on.
Check Settings > Filters/Forwarding for any rule you didn’t create — attackers often set up silent forwarding to keep access after a password change.
Check connected apps/OAuth permissions and revoke anything unfamiliar.
Review recent login activity/sessions and sign out of anything you don’t recognize.
Check your Sent folder for anything you didn’t send — a sign the account was actively used, not just accessed.
Wire fraud warning: once scammers have access to a real account, a common follow-up is impersonating the photographer to send fake invoices or “updated payment details” to their actual clients. If you’ve been compromised, alert recent clients directly by phone — not email — so no one wires money based on a message from your account.
Report to reportfraud.ftc.gov (http://reportfraud.ftc.gov) or ic3.gov(http://ic3.gov).
Going forward, consider a password manager so no password is reused across accounts.

Please share this alert with other photographers and creative professionals — this campaign appears to be actively targeting the industry right now.

Sign-up to receive our latest news

Includes chapter events, photographer interviews, partner discounts, industry trends, and more.

Join our list

Membership

Content