🕵️ They Already Know Your Name, Address and Website — That Doesn’t Mean They Know You

One of the oldest tricks in confidence work is knowing something about you before introducing yourself. The Internet just made the trick considerably easier.

We have been conducting an unintended little experiment lately over at Kilgore Heating & Air.

Nobody volunteered for it.

Nobody signed a consent form.

And nobody applied for a government grant.

But the experiment keeps arriving anyway.

Sometimes by email.

Sometimes through the website.

Sometimes through the postal service.

And each new specimen teaches us a little more about how modern small-business solicitations work.

Recently, Sheddie Kilgore received a rather official-looking notice concerning the Kilgore HVAC website.

It knew:

• 🏢 the business name,
• 🌐 the website domain,
• 📬 the mailing address,
• and enough other information to make the document look like it belonged in the stack of legitimate bills.

Sheddie did exactly what we want people learning to do.

He stopped.

He looked at it again.

He wondered whether something wasn’t quite right.

Then he brought it to me.

His scam radar is developing pretty dang quickly.

But his question led directly to today’s lesson:

How did strangers know all that information about his business in the first place?

The answer is important.

And, most of the time, considerably less mysterious than people imagine.

📖 Most Businesses Spend Years Telling Strangers Who They Are

Here’s the first great irony.

A small business wants to be found.

That’s the whole idea.

You put your business name on a sign.

You put your telephone number on the truck.

You build a website.

You create a Facebook Page.

You establish a Google Business Profile.

You get listed in directories.

You register with the state.

You put an address on your invoices.

You tell Google where you are.

You tell customers when you’re open.

You tell Facebook what kind of work you do.

You tell LinkedIn who works there.

Then one morning, some stranger sends you a remarkably personalized piece of mail and everybody says:

“How in the world did they know all that?”

Well…

We’ve been telling the world for twenty years.

🌎 Public Doesn’t Mean Secret — But It Also Doesn’t Mean Trusted

There is nothing inherently wrong with public business information.

Quite the opposite.

If you operate an HVAC company, restaurant, law firm, plumbing business, church, nonprofit, auto-repair shop or virtually any other local organization, customers need a way to discover you.

The problem comes when our brains make an understandable but dangerous leap:

“They know things about my business, therefore I must have a relationship with them.”

That conclusion no longer works.

A stranger knowing your business address proves they know your business address.

That’s about it.

🔎 Let’s See What a Stranger Can Learn

Suppose I know nothing about a local company except its name.

Depending on the business and what has been published publicly, I may be able to discover quite a bit without ever leaving my chair.

📍 Google and Online Maps

A public business listing may reveal information such as:

• business name,
• address,
• telephone number,
• website,
• business category,
• hours,
• photographs,
• customer reviews,
• and other business details.

That is exactly what these services are supposed to do.

The information helps legitimate customers find legitimate businesses.

It can also provide the raw ingredients for an unsolicited sales pitch.

🏛️ State Business Records

Businesses frequently appear in public government records.

Depending upon the state, entity type and record involved, public databases may identify things such as:

• the legal business name,
• business status,
• registered agent,
• filing dates,
• mailing information,
• and associated documents.

Again, none of this necessarily involves hacking.

A great deal of useful commercial information exists because business records are intentionally public.

🌐 Domain Registration Information

For decades, people associated domain searches with something called WHOIS.

The modern system for generic top-level domain registration data is increasingly based on something called RDAP — the Registration Data Access Protocol.

ICANN describes RDAP as the replacement for the traditional WHOIS protocol for accessing domain-registration information.

Some registration data may be publicly available while personal information can be redacted or access restricted depending upon the data, registrar, policies and applicable laws.

The important point for the average business owner isn’t learning another Internet acronym.

It is understanding that information about a domain can sometimes be discovered independently of the website itself.

📱 Social Media

A Facebook Page, LinkedIn profile, Instagram account or other social presence may reveal another layer:

• employee names,
• job titles,
• company anniversaries,
• new employees,
• equipment purchases,
• expansion plans,
• vendors,
• business events,
• customer relationships,
• and who appears to make decisions.

A perfectly innocent Facebook photograph might tell a customer:

“Look at our new service truck!”

To somebody assembling a sales database, the same post may say:

“This company is expanding and probably spending money.”

📄 Your Own Website

Then there is the information businesses publish themselves.

Your website may identify:

• the owner,
• employees,
• services,
• service area,
• telephone numbers,
• email addresses,
• customer testimonials,
• brands you sell,
• software integrations,
• business partners,
• professional associations,
• and sometimes the very problems you’re trying to solve.

That’s useful marketing.

But we should understand what happens after we publish it.

🤖 Now Add Automation

This is where the modern version gets interesting.

Twenty-five years ago, researching a thousand small businesses could require a small army of humans.

Somebody had to search.

Somebody had to read.

Somebody had to copy things into a spreadsheet.

Somebody had to write the letters.

Somebody had to stuff the envelopes.

Today much of that process can be automated.

Software can gather public business information, organize it, classify it, enrich it and prepare personalized outreach at a scale that would once have been economically ridiculous.

Artificial intelligence adds another layer.

Instead of sending everybody the same terrible letter beginning with:

Dear Business Owner…

a system can potentially create a message that references:

• your business by name,
• your town,
• your particular industry,
• your website,
• a service you offer,
• something visible on your website,
• and even apparent weaknesses in your online presence.

That message feels researched because, technically, it was.

But the research may have cost pennies and required almost no human involvement.

🎩 The Old Confidence Trick Got a Computer

Imagine a traveling salesman arriving in Dunlap a hundred years ago.

Before approaching the general store owner, he spends an afternoon sitting outside the courthouse.

He learns the store owner’s name.

He learns who owns the building.

He learns the name of the man’s brother.

He hears that the roof was recently replaced.

Then he walks into the store and says:

“Mr. Johnson, I was talking about that new roof of yours…”

Mr. Johnson immediately thinks:

“This fellow must know somebody I know.”

Maybe he does.

Maybe he doesn’t.

What the salesman really possesses is context.

Context creates familiarity.

Familiarity creates trust.

And trust lowers skepticism.

The Internet did not invent that trick.

It industrialized it.

🧠 Our Brains Are Part of the Problem

Humans use shortcuts.

We have to.

If every single decision required a six-hour investigation, none of us would ever get anything done.

So we naturally use signals.

Does this person know my name?

Do they know my company?

Do they know my website?

Do they know what industry I’m in?

Does the letter contain my correct address?

If several answers are yes, our brain quietly moves the stranger a little closer toward:

“probably legitimate.”

That’s the mental shortcut we need to update.

🚨 Accuracy Is Not Authentication

If there is one sentence worth remembering from this article, make it this one:

Accuracy is not authentication.

Someone can accurately know:

• your name,
• your domain,
• your address,
• your phone number,
• your employees,
• your bank’s name,
• your accountant’s name,
• or one of your vendors

without being any of those people.

Knowing a fact proves possession of the fact.

It does not prove identity.

It does not prove authority.

And it certainly does not prove that you owe somebody money.

📧 “But They Knew My Website Was Having Problems”

This comes up frequently with website and SEO pitches.

A message may say something like:

“We noticed errors on your website.”

Or:

“Your competitors rank above you.”

Or:

“We found SEO problems affecting your Google visibility.”

Those statements can sound impressive.

But many basic website characteristics can be observed remotely.

A person or automated system may be able to analyze things such as:

• page titles,
• site speed,
• broken links,
• public search rankings,
• mobile behavior,
• technical metadata,
• public backlinks,
• or visible website errors.

The fact that somebody found an issue does not automatically mean you should hire them to fix it.

If a stranger walks past your house and notices the gutter hanging loose, he may be completely correct about the gutter.

That doesn’t mean you should hand him the keys to the house.

📞 “But They Knew Who My Employee Was”

That isn’t necessarily impressive anymore either.

Employee information can appear on:

• company websites,
• Facebook,
• LinkedIn,
• news stories,
• professional directories,
• conference pages,
• public filings,
• and dozens of other places.

This is particularly important when somebody calls and says:

“I was talking to Tom about this.”

Perhaps they were.

Perhaps they weren’t.

The presence of Tom’s name doesn’t answer the question.

Call Tom.

🏦 “But They Knew Who We Bank With”

Now we are entering territory where verification becomes even more important.

Information about commercial relationships can sometimes be inferred or discovered through public records, social connections, prior communications, compromised data, forwarded messages or ordinary conversation.

Never let the possession of one correct fact substitute for independent verification when money, passwords or sensitive information are involved.

The Federal Trade Commission specifically recommends training employees to recognize business scams and warns that scammers often impersonate trusted organizations or create urgency so people act before checking the claim.

The antidote is wonderfully unexciting:

Check independently.

☎️ Don’t Verify the Stranger by Asking the Stranger

This deserves its own section.

Suppose an unexpected letter says:

Call 1-800-SOMETHING to verify your account.

If the letter itself is questionable, using the telephone number printed on it doesn’t provide much independent verification.

You’re asking the source of the claim whether the claim is legitimate.

Instead:

• go to the company’s known website independently,
• use a telephone number already in your records,
• log into the account through your normal bookmark or application,
• contact the employee or vendor through an established channel,
• or ask another knowledgeable person to look at the request.

That’s what independent verification means.

🐟 Personalization Is No Longer Proof That a Human Wrote It

Here’s another mental model we need to update.

People used to assume:

Generic message = mass mailing.

Personal message = somebody researched me.

That distinction is disappearing.

Automation and AI can create individually tailored messages at mass-mailing scale.

One thousand recipients can receive one thousand different messages.

Each one can potentially contain different names, industries, websites and talking points.

We should therefore stop treating personalization itself as evidence that meaningful human due diligence occurred.

That doesn’t make personalized marketing bad.

Good businesses use personalization too.

It simply means personalization is no longer a reliable authenticity test.

👨‍🔧 Back to Sheddie

This is why I’ve been encouraged watching what is happening with Sheddie Kilgore.

The first strange solicitation is confusing.

The second one feels familiar.

By the third or fourth, you start recognizing patterns.

Sheddie isn’t suddenly becoming a cybersecurity engineer.

He doesn’t need to.

He is developing something more useful for everyday business:

pattern recognition.

He sees the official-looking paperwork.

He notices the familiar business information.

But increasingly, instead of thinking:

“They know who I am, so this must be legitimate,”

he is beginning with:

“Wait a minute. Who are these people?”

That’s progress.

And I suspect that lesson is worth considerably more than the $288 he didn’t send somebody for a directory listing.

🛡️ The New Small-Business Trust Model

For years, we informally trusted messages when they contained enough familiar information.

We need a better model now.

❌ Old Rule

They know something about me, therefore they’re probably legitimate.

✅ New Rule

They know something about me, therefore they know something about me.

That’s all we’ve established.

Now verify the rest.

🔐 The Six Questions to Ask When Somebody Seems to Know Too Much

1️⃣ Who Are You?

Identify the actual organization and person making contact.

2️⃣ How Would You Normally Contact Me?

Does this match an established relationship?

3️⃣ Did I Ask for This?

Unexpected doesn’t automatically mean fraudulent, but it deserves additional scrutiny.

4️⃣ What Exactly Are You Asking Me to Do?

Pay money?

Click a link?

Scan a QR code?

Download something?

Reveal a password?

Change payment instructions?

The requested action matters more than how impressive the message looks.

5️⃣ Can I Verify This Somewhere Else?

Use a second source that did not come from the original message.

6️⃣ Why Is This Urgent?

Urgency is one of the oldest ways to prevent somebody from stopping long enough to think.

If a stranger needs you to make a financial decision in the next six minutes, those may be the six minutes when you should move the slowest.

🤠 Grandpa Had This Figured Out Before We Invented the Internet

There was an older phrase for all of this:

“Who sent you?”

A stranger showed up at the farm claiming to be there about the tractor?

Who sent you?

Somebody arrived to pick up cattle?

Who sent you?

A man came around collecting money?

Who sent you?

Nobody demanded that Grandpa understand cryptography.

He simply understood that a stranger knowing his name did not transform the stranger into family.

We may need to resurrect some of that thinking.

🌐 Visibility Has a Price — But Hiding Isn’t the Answer

There is a temptation after learning all this to say:

“Fine. I’ll take everything off the Internet.”

That’s generally the wrong lesson for a business.

Your customers need to find you.

Your website needs useful information.

Your business profile needs to be accurate.

Your telephone number needs to be available.

Visibility is part of doing business.

The solution isn’t disappearing.

The solution is understanding that visibility works in both directions.

The same information that helps a legitimate customer find you can help an aggressive marketer find you.

And sometimes it can help a dishonest person sound considerably more familiar than he really is.

🧠 Information Is Cheap. Trust Shouldn’t Be.

That may be the larger lesson of the AI age.

Information that once required a detective can now require a search box.

Research that once required hours can increasingly be automated.

Messages that once required a copywriter can increasingly be generated by software.

Personalization is getting cheaper.

Trust therefore needs to become more expensive.

Not impossible.

Not paranoid.

Just earned.

✅ The Dunlap.Today Public Information Test

The next time an unfamiliar person contacts your business and seems to know an awful lot, remember:

• ✅ Your address may be public.
• ✅ Your telephone number may be public.
• ✅ Your website is definitely public.
• ✅ Your business registration may contain public information.
• ✅ Your employees may identify themselves publicly.
• ✅ Your social media may reveal business activity.
• ✅ Parts of your domain-registration information may be publicly available.
• ✅ Software can combine information from multiple sources.
• ✅ AI can turn those facts into personalized communication.

None of that proves the sender has a relationship with you.

So here’s the sentence I’d put on the wall beside the checkbook:

Accurate information is not authentication.

Sheddie is learning it.

We’re learning it right along with him.

And every time somebody brings us another strange letter, email, invoice or sales pitch, we’re going to dissect the dang thing until the rest of Sequatchie County learns it too.

📚 Sources & Further Reading

Federal Trade Commission — Scams and Your Small Business

The FTC recommends educating employees about business scams, independently verifying suspicious requests and being particularly cautious when someone creates urgency or impersonates a familiar organization.

ICANN — Registration Data Access Protocol (RDAP)

ICANN explains that RDAP provides access to domain-name registration data and has replaced traditional WHOIS as the primary protocol for generic top-level domain registration information.

ICANN — Domain Registration Data Lookup

ICANN provides a public lookup service for registration information that is available for a domain, while some personal data may be redacted or subject to restricted access.

💬 Got Something Strange? Send It to Us

Has your business received a suspicious invoice, unusual renewal notice, strange website offer, unexpected SEO pitch, questionable text message or something else that just didn’t smell right?

Don’t automatically throw it away.

Take a picture first.

Send it to Dunlap.Today.

It might become the next lesson in Small Business Scam School.

Because the best way to make these tricks less effective is to teach everybody how the trick works.