He Pitched Me His Cold Email System Using His Own Template (Here's How I Caught Him)

A stranger emailed me this week offering to build The Coastal Collaborative a "done-for-you outbound system." Autopilot meetings, 4 to 8 high-ticket clients a month, and if I got on a sales call with him, he'd buy me a camera and a ring light so I'd look sharp.

As proof, he attached a Notion doc: 30 cold email templates that "book meetings on auto-pilot."

So I did the thing I always do. I put his email next to his evidence.

His email WAS the template. Word for word. The subject line was the {{lead achievement}} merge field, filled in with something an AI scraped off my website. The "since you've accomplished X" opener, straight from the doc. The P.S. with a "personal observation"? That's a fill-in-the-blank field too. He pitched me his product by running his product on me, and the product told on itself.

I get some version of this email every week, and I bet you do too. So here's exactly how to tell a real cold email from an automated one, using this guy as our example. No technical background required, I promise.

Check the domain first.

His email came from a .click domain. Not .com, not even .io. A .click domain costs a few dollars, and cold emailers buy them specifically as burners. When the domain gets flagged for spam (and it will), they throw it away and their real website never takes the hit.

The check: look at everything after the @ in the sender's address. If it's a weird variation of a company name on a cheap ending like .click, .site, .top, or .xyz, someone is protecting their real domain from the consequences of what they're sending you.

The "did you see my last message?" trick.

His email asked if I'd seen his previous message. Feels personal, right? Someone following up?

Nope. Sequence software stamps each new email as a reply to the last one automatically, so a mass blast lands in your inbox looking like an ongoing conversation. There is no "him" checking whether you replied. There's a dashboard counting opens.

The check: scroll down. If the "previous message" quoted below arrived the same way, out of nowhere, from the same stranger, you're not in a conversation. You're in a sequence.

Personalization that's almost right.

His email said we go after "business owners, operations managers, and marketing partners." Close! It also compared us to "other media sponsorship sales companies going after the same type of leads."

We are not a media sponsorship sales company. Not even a little.

That's the tell of AI personalization. It scrapes your website or LinkedIn, summarizes you back to yourself, and gets you about 80% right. A human who actually looked at your business doesn't miss what your business is.

The check: does the "personal" detail sound like a slightly-off book report about you? A real person references something specific and gets it right. A robot references something general and gets it weird.

Proof you can't check.

His numbers: 13 booked meetings a week. $80k in quoted MRR for one client. Another client closed "3 deals worth $75k-100k."

No links. No full company names you can verify. No way to check any of it. Real case studies survive a Google search. Fake ones are built so you can't run one.

The check: take any claim and try to verify it in 60 seconds. If you can't, it wasn't proof, it was decoration.

"Passing the spam filter" doesn't mean legit.

Here's the one that surprises people. This email passed every authentication check Google runs. SPF, DKIM, DMARC, all green.

Those checks only prove one thing: the sender really controls the domain they sent from. A spammer who sets up his burner domain correctly passes with flying colors. Authentication tells you the envelope isn't forged. It says nothing about whether the letter inside is honest.

The uncomfortable part: the mechanics work.

Here's what I'm not going to tell you: that cold email is evil and automation is a scam.

I automate things for a living. The mechanics in that template doc are real. Specific subject lines, genuine observations, useful follow-ups, a clear reason for reaching out. That's just good outreach.

The difference between outreach and spam isn't automation. It's whether any of it is true. When I contact a business, it's because I actually looked at their website and found something real. A leak. A broken form. A page their customers can't reach. I don't need a merge field to pretend I did the work, because I did the work.

Automation isn't the problem. Automated lying is.

The 30-second checklist.

Next time one of these lands in your inbox:

1. Look at the domain. Cheap ending, weird name? Burner.

2. Scroll to the "previous message." Did it also come from nowhere? Fake thread.

3. Read the personal detail. Slightly wrong about your business? Robot.

4. Try to verify one claim. Can't? Decoration.

5. Then delete it without replying. Any reply, even a clever one, tells their software your address is live and gets you moved to a hotter list.

That last one hurts, I know. I wanted to reply to my guy SO badly. But silence is the only response that costs them and never costs you.

Want someone to actually look at your business?

That's the whole idea behind my free 5-Minute Ops Quiz. 6 questions, 5 minutes, no call, no pitch. It points you at the leaks costing you time and hands you the list. A real look, not a merge field.

Simple as that.