Verdict: Assume it's fake until the sender proves otherwise. Verification beats optimism, every time.
If you run a business worth $500,000 to $5 million and an email lands in your inbox saying a private equity firm wants to buy you, the odds favor a scam. ConsumerAffairs reported on July 20, 2026 that a growing wave of near-identical emails is targeting small business owners with fake acquisition offers, hunting for financial data, upfront fees, or system access. Real private equity firms do cold-email business owners in the lower-middle market, the $1 million to $100 million range. But they don't target "mom-and-pop" shops, and they never open with a vague pitch about "a private equity firm in our network."
I've spent 27 years on the other side of this exact conversation. Angel Investors Network, the firm I founded in 1997, has helped clients raise more than $1 billion in capital. I've read thousands of real acquisition and investment inquiries. I can tell you what a genuine one looks like in the first three sentences, and I can tell you why the fake ones all read the same.
The scam, in the sender's own words
ConsumerAffairs documented the script. It shows up with minor variations, but the bones are identical:
"We have a private equity group (or family office) looking to acquire businesses in your space. Would you be available for a brief call?"
Or:
"One of our clients is actively seeking acquisitions in your industry and thought your business would be a good fit."
No firm name. No principal. No revenue range.
No deal structure. Just a request for a call, sent to an inbox the sender never researched.
Security researchers cited in the ConsumerAffairs piece found nearly identical wording sent by fake firms and anonymous senders alike, sometimes to businesses that had already dissolved. That last detail matters. A dissolved business getting an "acquisition offer" isn't a targeting error. It's proof the list was scraped, not built.
Reddit's r/scams and r/smallbusiness communities have been logging these for over a year. Recipients who tried to verify the sender's supposed employer found the person, and sometimes the firm itself, didn't exist. The pattern echoes what the FTC's small business scam guide has flagged for years: unsolicited outreach that leads with flattery and urgency, then pivots to a request for money or data, is the oldest structure in the fraud playbook. Only the wrapper changed.
There's no single scam. There are five.
The FBI's 2025 Internet Crime Complaint Center annual report recorded $20.877 billion in total cybercrime losses, a 26% jump from 2024. Business email compromise alone accounted for $3,046,598,558 across 24,768 complaints, an average loss of roughly $123,000 per incident, with 86% of that money moving by wire transfer. Fake acquisition outreach is a feeder channel into that number. Investigators cited by ConsumerAffairs have mapped the endgames:
Lead generation. The sender resells your contact information to brokers or hands you off to a lead-gen mill posing as a buyer.
Paid valuation scam. You express interest, and the "buyer" suddenly requires an independent valuation or due diligence report. Which you must purchase. From them.
Advance-fee fraud. Weeks into the exchange, they ask for legal fees, an escrow deposit, or a "processing" charge before the deal can proceed. The deal never proceeds. The money doesn't come back.
Business intelligence harvesting. No money changes hands at all. They just collect your revenue figures, customer list, supplier relationships, and org chart. That data has resale value on its own.
Phishing and BEC setup. Later messages arrive with an "LOI," an NDA, or a financial questionnaire as an attachment. Open it and you've installed malware or handed over credentials. In the worst version, the early conversation is just reconnaissance for a future wire-fraud impersonation attempt against your own finance team.
What a real buyer's first email looks like
At AIN, we've facilitated over $1 billion in capital transactions since 1997. I can tell you exactly what a real buyer's first email looks like. It names your industry, your approximate revenue range, and the deal structure they're considering. It does not say "a private equity firm in our network is interested in your space." That's a fishing expedition.
Real lower-middle-market outreach has its own mechanics, and they're documented, not mysterious. Search fund operators typically send 200 to 500 cold emails a month. PE platforms running add-on programs send 500 to 2,000.
The top quartile gets 5% to 7% reply rates and converts 0.3% to 0.5% into a signed letter of intent, according to CT Acquisitions' 2026 cold email guide. That's a real industry with real math, run by real people who sign their own name. A named individual outperforms a generic firm address three to five times over.
The first ask from a legitimate buyer is a 15-to-30-minute call. Nothing more. No financials. No NDA on message one.
If the sender can name your sector, your rough size, and a plausible reason they're looking there, they did their homework before hitting send. Scammers skip the homework because they're not selecting targets. They're spraying a list.
Five red flags of a fake buyer
- No identifiable firm. They mention "a private equity group" or "a client" without naming it. Ask once, directly, and watch the deflection.
- Free or newly registered email domain. A Gmail address, or a domain registered within the past few months, is not how institutional capital operates. Real firms email from their own domain with a website behind it.
- Generic, mass-mailable language. The message reads like it could have gone to a thousand businesses, because it did. No mention of your revenue, your niche, or anything specific to your operation.
- Refuses to name the buyer before a call. Legitimate advisors will identify themselves and their client after an NDA. A scammer wants you on the phone first, unarmed, before any paper trail exists.
- Immediate request for confidential financials. Real buyers ask reasonable, general questions before requesting financials. A stranger demanding your P&L on message two is not doing diligence. They're doing reconnaissance.
Five signs of a legitimate buyer
- A verifiable firm with a real website and named professionals. You can find the firm's partners on LinkedIn, cross-reference their deal history, and confirm they've closed transactions in your sector before.
- Corporate email matching the firm's domain. Not a personal account, not a free provider. The sender's address resolves to the firm's own domain.
- Willingness to identify the actual buyer under NDA. Once you've signed a mutual NDA, a real buyer or their advisor will name the acquiring entity and share credible background.
- No request for money from you, ever. The buyer pays for their own diligence, their own valuation work, their own legal fees. If they ask you to pay for anything before a deal closes, the deal is not real.
- Specific, sector-relevant questions before financials. They ask about your customer concentration, your recurring revenue mix, your team structure. General business questions, not a demand for bank statements on day one.
What to do if the email lands in your inbox
Run this like a casualty drill, not a negotiation. Compartmentalize the decision before you respond to anyone.
Verify the firm independently. Don't click anything in the email. Search the firm's name plus "private equity" or "acquisitions" in a new tab. Check their website's About page against what LinkedIn shows for their team.
Check LinkedIn for the sender and the firm. A real M&A professional has a work history and a profile that predates this week. A profile created two months ago with no verifiable history is a flag, not proof of guilt, but a flag.
Ask for specifics before you say anything real. What sector, revenue range, and deal structure, asset purchase or stock purchase, are they considering, and who is the actual buyer? A real buyer answers without flinching. A fake one stalls or gets vague again.
Never share financials before an NDA, and never pay anything upfront. No legitimate buyer needs your P&L to schedule an introductory call, or asks you to fund a valuation or escrow account before a deal exists on paper.
Route it through an advisor before you engage further. If a real buyer is interested, an M&A advisor, attorney, or accountant should see the email first. That's the same due diligence discipline a buyer would run on you.
The math that makes this scam work
Scammers aren't gambling on getting your money in one shot. They're gambling on flattery lowering your guard.
Most owners in the $500,000 to $5 million range have never been approached by a real acquirer, so the idea hits an emotional nerve before it hits a logical filter. That's the exploit. Not technical sophistication. Ego.
The ConsumerAffairs reporting makes the targeting logic explicit: "mom-and-pop" businesses are unlikely acquisition targets for institutional buyers, which is exactly why a vague, flattering buyout offer aimed at that segment should read as a red flag, not good news. Real lower-middle-market buyers hunt for three to five years of clean financials, a management layer beyond the founder, and enough scale to justify deal costs. If your business doesn't clear roughly $1 million in revenue with real systems behind it, the odds a PE shop is hand-picking you from a cold list are close to zero.
This is where the Owner-Operator Frame matters. An operator who has built a business worth acquiring already knows, roughly, what it's worth and who would plausibly want it. That baseline knowledge is your best filter. If the offer doesn't match the math you already know about your own balance sheet, the offer is the lie, not your business.
Report it, don't just delete it
The FTC and the BBB's Scam Tracker both take reports on this exact pattern, and reporting matters beyond your own inbox. File a report at ReportFraud.ftc.gov and forward phishing attempts to the Anti-Phishing Working Group. Every report feeds the database that eventually gets a domain flagged before it reaches the next owner who hasn't seen this article yet.
If you want the fuller system for protecting the business itself, not just the inbox, that's the Sovereignty Stack approach: build the operation so a buyer, real or fake, can't extract anything from you that you haven't already decided to share. And if you're actually preparing to sell, on your terms, to a vetted buyer, the Owner's Exit Engine walks through what real due diligence looks like from the seller's side, so you know exactly how far off-script the fake version really is.
Doctrine Connection: Verification beats optimism
Every fake acquisition email is selling the same product: the feeling that you've already won. That someone recognized the value you built without you having to prove it.
Real buyers don't sell that feeling. They ask questions, they wait for answers, and they let the numbers do the convincing. Optimism is not due diligence. It's the absence of it.
Verify the firm, verify the sender, verify the deal structure. Only then decide whether the offer is worth another hour of your time.
FAQ
Q: Are all unsolicited acquisition emails scams? No. Private equity firms, investment banks, search funds, and M&A brokers routinely cold-email business owners in the lower-middle market, roughly $1 million to $100 million in value, as competition for deals has intensified. The volume of legitimate outreach has genuinely increased. The difference between real and fake is specificity: a real message names a sector, a rough size range, and eventually a buyer. A fake one stays vague on purpose.
Q: I already replied and shared some basic information. What now? Stop before you share anything else, especially financials. Verify the firm's identity independently through LinkedIn and its own website, not through links in their emails. If you can't confirm the firm and its people exist outside the conversation, treat everything sent so far as compromised and involve an attorney before responding again.
Q: Why would a scammer target a business that's clearly too small for private equity? Because the response, not the acquisition, is the product. Even a small percentage of owners who reply, share data, or eventually pay a "valuation fee" makes the mass-email campaign profitable. The scam doesn't need your business to be a real PE target. It needs you to believe, briefly, that it might be.
Q: What's the one question that exposes a fake buyer fastest? Ask for the name of the acquiring firm and the deal structure, asset purchase or stock purchase, before agreeing to a call. A real buyer or their advisor answers directly, often after an NDA. A scammer deflects, repeats vague language about "a firm in our network," or tries to move you to a phone call instead of answering in writing.
Q: Should I get a business broker or M&A advisor involved even if I'm not trying to sell? Yes, the moment the email asks for financials or money. An advisor has seen the pattern before and can verify a firm's legitimacy in minutes using networks you don't have access to. That's a cheap insurance policy against a scam that costs, on average, over $100,000 when it succeeds as full business email compromise.