Spotting the hidden signs in author-feature scam emails

You're already well aware of this: flattering, unsolicited emails offering to "feature" your book or story with a reading group or community.

I actually engaged with one, hoping to find a way to expose them. While I haven't yet, I did look closely at the scammer's messages and found some technical signatures - things you can check for yourself to see if it's the same group targeting us all. This page explains what to look for and how to find it. If you have received one of these emails, you can help by checking it for the same signs.

Nothing on this page asks you to reply to a scammer, click anything, or install anything. Reading an email's raw source, which is the core skill here, loads nothing and is completely safe. I engaged my scammer to the point where they sent me a payment link and then when I stalled they split it into three payments with three different links. I cannot and do not advise doing this. I'm an old hacker, so I was able to do so without compromising myself through sophisticated tools.

First, a note for Apple Mail users

Apple Mail has a feature called Mail Privacy Protection ("Protect Mail Activity"), turned on for most users by default. It quietly loads a message's remote images through Apple's own servers the moment the message arrives. Because of that:

A sender may record that you "opened" an email you never actually opened. It just has fake Apple location and device details. I don't think the scammers care about your IP address or anything. I think they only care about the "open" beacon.
Blocking images on your device, or with a network blocker like Pi-hole, does not stop it, because the loading happens on Apple's servers, not on your machine.
Most importantly: this doesn't remove the tracking pixel from the email. The pixel is still sitting in the message's raw source. You find it by reading the source (explained below), not by watching whether an image "loaded."

Short version: with Apple Mail, "did it load?" tells you nothing useful - but the evidence is still there to read.

What the scam looks like

The details vary, but the pattern is consistent:

An unsolicited, flattering email offers to "feature" your book at a reading group, book club, festival, or community event.
Over one or more friendly replies it builds trust, often by pointing to a real group you can look up - so "verify us independently" actually seems to check out.
Eventually there is a fee - a "participation" or "feature" charge - paid through a payment link.

Easy red flags, no technical skills required:

A free email address (like an @gmail.com address), not from the group's official channel or domain. If a real organization is named, check how that organization says it actually contacts people. For example, a group on Meetup might explictly say they only use the platform to message you.
A genuine community book club doesn't charge authors a fee to be discussed. Any fee to be "featured" is the scam.
When they describe your book, it only ever echoes your public blurb or sales-page text - they fluff it up so it reads like high praise, but it's nothing a real reader of your book would say. Mine kept shuffling the same list of seven genre names/adjectives and pointing out the two character names from my blurb.

The real groups are victims too. The scammers impersonate genuine clubs and their organizers to borrow their good reputation. If you look one up and it's real, that doesn't mean the email is from them - it usually means their name is being misused.

The main hidden thing: a tracking pixel

Emails like this usually have a tracking pixel: a tiny, invisible image (typically zero or one pixel in size) embedded in the message. When your mail app loads it, it silently tells the sender you opened the email. That alone is common in marketing mail - but in these scams the pixel's web address usually carries an account number that identifies the sender's tracking account. I've also seen stories from people who barely avoided being scammed, where the scammer fought back against hesitation by saying something like, "Well you opened the email 7 times so something about what I said must have resonated..."

Anyway, that account number is the useful part. If my theory is correct, it should stay the same across all of one operator's messages, even when they change their display name, their story, or the group they claim to represent. So if two authors each find the same account number in their raw source, they can be confident the same operator sent both - regardless of the names used. Or, if the numbers change but the site with the tracker is the same, that's a good sign of switching to another account after one got suspended. That's the pattern I'm hoping to establish.

What it looks like in the source

In the raw source you're looking for an HTML image tag pointing at a tracking address with an account parameter. A made-up example (this is not a real address - it just shows the shape):

<img width="0" height="0" src="https://tracker.example.com/trace/mail/<random-id>.png?u=NNNNNN">

How to find it - use your viewer's Find (Ctrl+F / Cmd+F) inside the raw source and search for any of these:

<img - then look for ones with width and height of 0 or 1.
Words that show up in tracking addresses, such as trace, pixel, track, or open. The scammer I dealt with was using a pixel from p.mailmerge.eu, and the word, trace was in the image path.
An account parameter in a web address: u=, user=, or uid= followed by a number. That number is the account identifier worth writing down.

Do you see `=3D` in the raw source?

Raw email is often stored in an encoding called quoted-printable, where a plain = sign is written as =3D. So an address that really reads ?u=12345 may appear in the source as ?u=3D12345. The 3D is just the encoding - the actual account number is 12345. Likewise width=3D"0" simply means width="0". If a web address seems to break across two lines with an = at the end of a line, that trailing = is a soft line break; the address continues on the next line.

How to view an email's raw source (and save it)

"Raw source" is the complete, unrendered text of the email, including the hidden parts. Saving it as an .eml file gives you a copy you can keep as evidence or share with someone.

Please let me know if any of these instructions are incorrect or missing steps, or if you have a better method. I had to "ask the duck" for some of the steps so I'm not sure how accurate they are.

Gmail (in a web browser)

Open the message.
Click the three-dot More menu (top right of the message).
Choose Show original. The full raw source opens in a new tab.
To save it, click Download Original on that page - it saves an .eml file.

Apple Mail (macOS)

Select the message.
In the menu bar choose View → Message → Raw Source (keyboard shortcut Option-Command-U).
To save a copy, either drag the message from the list onto the Finder or your Desktop (this creates an .eml file), or forward it to yourself as an attachment (Message menu → Forward as Attachment) so the original is preserved intact.

Outlook on the web

Open the message.
Click the three-dot (More actions) menu at the top of the message.
Choose View → View message source to see the raw source. You can select all of it and copy it into a plain-text file.

Outlook desktop (Windows)

Open the message in its own window (double-click it).
To save the whole message, choose File → Save As and pick the .eml (or Outlook Message) format - or simply drag the message from the list onto your Desktop.
To see just the technical headers, choose File → Properties and read the Internet headers box at the bottom.

On a phone (iOS Mail, the Gmail app, most Android mail apps)

Most phone mail apps don't have a way to show the raw source or save an .eml file. As far as I can tell there are two reliable workarounds:

Forward the message to yourself as an attachment if your app offers it, then open that attachment on a computer.
Or open the same mailbox in a desktop web browser (for Gmail, use Show original as above) and do it there.

If you find anything useful

If you'd rather not do any of the steps below, you can totally hand off the information you find to me and I'll add it to my growing pile of scammer evidence. If you'd like to take action yourself:

Do not pay, and do not click the links. Reading the raw source is all you need; the links can wait for the people whose job it is to investigate them.
Report it. Use your email provider's "report phishing" option; if there is an invoice, report it to the payment company named on it. In the United States you can also file with the FBI's Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov. (Both links open external sites.)
Let the impersonated group know, if possible. I found the book club my scammer was impersonating on Meetup. They already had two notices about the scammer, which is great, but not every group will.
Keep the evidence - save the .eml file. The raw source holds everything an investigator needs, including the account number described above.