If you buy guest posts, or sell them, you will get this email sooner or later. Someone claims to own a blog, says your team published a guest post on it and never paid, and gives you 24 hours to settle up. It is a shakedown, and nothing is owed.
We know because our own clients keep forwarding it to us. The email names a post we placed for them, so they assume we never paid the publisher and that the threat is now landing on them. That is not what happened. Every publisher we work with is paid when the post goes live, and the person sending the email has nothing to do with the site.
How the scam works
The email comes from someone posing as a blog owner or editor. They say a member of your SEO team ordered a guest post, the post went live, and nobody paid. To make it look real they paste a link to a live post, often one that really does carry your link.
Then come the threats. Pay within 24 hours or they publish your email address in an article calling you a scammer, point adult and casino links at your site, and spam your site in Google.
Text of that message, as received:
Hi
One of your SEO team members takes Guest Post on our website and now he /she is not replying to me.
You can see your links placement by opening the following posts URL:
https://www.blog post link
If you'll not paid within next 24 hours will publish your email ID in Article as a scammer, and also will start negative SEO on your sites, i have many sites adult and casino related will publish your links there and also will spam your site in google, Last and final warning, just pay for it, otherwise you'll get response from google for your site,
Just Pay us, otherwise you will be responsible.
Thanks
There is also a softer version: "I am the admin of this website, I did your post but never received payment, I will delete it in 24 hours." It comes from the same kind of sender and wants the same thing.
The scammer does not know who ordered what or who paid whom. They send the same email to anyone whose link they can find in a guest post. Guest posting agencies get it, their clients get it, and so does any business that places its own guest posts. They are counting on one person in the chain panicking and paying, and the client is the easiest target because the client was never part of the deal with the publisher and cannot check it themselves.
How to spot it
The sender's address gives it away. A blog owner chasing a real payment writes from the blog's own domain. These emails come from Gmail or another free account.
The rest of the pattern is just as consistent: a 24-hour deadline, threats of negative SEO and public shaming, and no order details at all. They cannot name the person who supposedly placed the order or the price that was agreed. A real publisher with an unpaid invoice sends the invoice.
How to confirm
Do not reply to the email. If an agency placed the post for you, forward the email to the agency. They know which posts they placed and which publishers they paid, and they can show you the record for that post. Our clients who forward these to us get that confirmation the same day.
If you placed the post yourself, you already know who you dealt with and what you paid. An email from a stranger on a Gmail address is not that person.
What to do
Do not pay. Block the sender. Expect another attempt from a different address. If you want to go one step further, tell the real blog owner someone is impersonating them, since the scam also damages their name.