Yesterday, I almost got duped by an email that had all the hallmarks of a legitimate legal notice—from a prestigious law firm, no less. The subject line screamed urgency:

“FINAL LEGAL NOTICE PRIOR TO INTERNATIONAL LITIGATION.”

As the founder of Doctors on Social Media, I’m no stranger to messages about copyright flags or licensing questions. But this one? It hit different.

The email looked official. The sender claimed to be from Cravath, Swaine & Moore LLP, one of the most respected law firms in the country, acting on behalf of Universal Music Group. According to the email, I was being accused of copyright infringement for using 45 seconds of Lewis Capaldi’s “Someone You Loved” in a Facebook video. (Side note: I had no memory of using that song in anything, ever.)

There was a case number. There were specific timestamps. There were references to U.S. copyright laws, the DMCA, the Berne Convention.. even citations of legal code that looked straight out of Suits. The firm’s logo and footer matched the real one from Cravath’s website. It was clearly written by someone who knew legal language, and how to induce panic.

But then came the twist.

The email contained a link. Supposedly, it would direct me to the offending post so I could “verify” the content in question. When I clicked it, it prompted me to log back into Facebook, even though I was already logged in (which I happen to know because my work is primarily on the computer these days, but I can also see how people could easily make that mistake). Then came the “verification” steps. That’s when my inner red-flag alarm started blaring.

Why was I being redirected to a Facebook login page through an unfamiliar domain?
Why was there no screenshot or direct reference to my actual post?
And most of all, why, in tiny gray font at the bottom of the email, did it say: “Made and sent with Mailmerge”?

Mailmerge.
That was the giveaway.

What legitimate legal notice gets blasted out via a mailer app?

Curious and cautious, I called the phone number listed in the email – the actual number for Cravath, Swaine & Moore. A real person answered the phone. I explained the situation, and within seconds, she told me flatly:

“Oh no, honey. That’s a scam. Happens all the time.”

I had already clicked. Luckily, I didn’t enter any login information or move forward with “verification.” But it was close.

Here’s What Made This Scam So Believable:

• It used a real firm’s name and branding
• The legal language was sophisticated and specific
• It invoked fear and urgency
• It linked to a fake but convincing login page
• It included real legal references and threats of serious consequences

This isn’t your average “Nigerian prince” phishing attempt. This was precision-engineered to manipulate creators, entrepreneurs, and anyone managing digital content.

Here’s the takeaway:

If you ever receive a legal-sounding email accusing you of copyright infringement:

• Don’t click links inside the email
• Check the sender address and domain
• Search for suspicious language like “mailmerge” or “bulk message”
• Call the alleged sender directly, using a number you look up yourself
• When in doubt, don’t act out. Pause and investigate

In an era where scams are evolving faster than we can report them, let this serve as your friendly neighborhood reminder:

Even an email that looks like a lawsuit might just be a cleverly disguised link to you giving up your login credentials.

I share this so that you don’t fall into the same almost-trap I did.

Stay alert, stay skeptical, and, for the love of reel-creation, don’t click strange links.