Security Notice: Scam Emails Impersonating 84EM
A scam email is impersonating 84EM and Andrew Miller. Here's what it looks like and how to verify that an email really came from 84EM.
Last updated: July 3, 2026
What happened
On July 2, 2026, someone sent a scam email impersonating 84EM and Andrew Miller. It went to at least one of 84EM’s clients. A client recognized it as fake and flagged it immediately.
The email came from [email protected], an address 84EM doesn’t own. The subject line was “Important: WCAG Compliance Review for Your Website,” and the body pitched routine WordPress maintenance work in an attempt to start a billable conversation.
How to verify email from 84EM
Every legitimate email from 84EM comes from an address ending in @84em.com.
84EM never sends business email from Gmail, Outlook.com, Yahoo, or any other free email provider. If an email claims to be from 84EM but the sending address isn’t @84em.com, it’s fake, no matter how convincing it looks.
If you’re ever unsure, don’t reply to the suspicious email. Email [email protected] and ask.
What the fake looks like
The scam email is shown below, recreated with the recipient’s information removed. A few things worth noticing:
- The sending address is [email protected]. Real 84EM email comes from @84em.com.
- The photo is real. It’s Andrew’s actual headshot, likely scraped from this site.
- The company name is wrong. There is no “84EM Web Engineering.” The company is 84EM.
- The title is wrong. Andrew’s title is Principal Engineer, not “CEO & Senior Web Developer.”
- The images at the bottom are copied from this website. The scammer lifted real figures to make the signature look credible.
The original email also contained a hidden tracking pixel that tells the sender when the message is opened.
If you received one of these
- Don’t reply, click anything, or download attachments.
- Forward it to [email protected]. It helps track how widespread the campaign is.
- Delete it.
If you already replied, don’t panic. Just stop responding and let 84EM know.
What 84EM has done
The sending account has been reported to Google. This page will be updated if the campaign changes or new variants appear. From: Andrew Miller [email protected] Sent: Thursday, July 2, 2026 10:38 PM Subject: Important: WCAG Compliance Review for Your Website Hi there I hope you’re doing well. As part of my ongoing review of your website, I wanted to provide an update regarding several components and services that are due for routine maintenance. To ensure your website continues to perform reliably, remains secure, and stays compatible with the latest technologies, I recommend scheduling a maintenance update over the coming weeks. This will include reviewing and updating WordPress core, plugins, themes, and other key website components where required. Routine maintenance is an important part of keeping any WordPress website running smoothly. Delaying updates can increase the risk of issues such as: By addressing these items proactively, we can help maintain the website’s stability, security, and overall performance while reducing the likelihood of avoidable issues in the future. As part of my ongoing support, I wanted to bring this to your attention early so we can schedule the work at a convenient time and ensure everything remains up to date. Please let me know if you would like me to proceed with the recommended maintenance, or if you would like a detailed breakdown of the work involved before scheduling. I look forward to hearing from you. Kind regards, (followed by a fake 84EM email signature)
Read the full text of the scam email
Not sure an email really came from 84EM?
Forward it to [email protected] and you'll get a straight answer. No forms, no follow-up sequence, just confirmation either way.
