That “MIT Press Editor” in Your Inbox Probably Isn’t One

14 October 2026 · 4 min read · Syed Omar Faruk Towaha

This morning I got a flattering email. A "Senior Editor at The MIT Press" had come across JavaScript Projects for Kids, the book I wrote for Packt in 2016, and had kind things to say about it: the project-based approach, the Battleship game, the Pac-Man-style Canvas chapter. She wanted to hear about my current and upcoming projects. Then she asked whether I had a literary agent, and offered to "outline how the process typically works" if I didn't.

It is nice to read. It is also a scam. Here is how I worked that out, so you can spot the next one.

1. The sender's address

The email came from susanmh.mit.edu@gmail.com.

MIT Press staff write from @mit.edu addresses. Putting "mit.edu" inside a Gmail username is an old trick: when you skim, your eye catches "mit.edu" and stops checking. The authentication headers settle it. SPF, DKIM and DMARC all pass, but only for gmail.com. Nothing in the message connects it to MIT's mail servers.

Rule: a publisher, agent or university editor writes from the organization's own domain. Gmail, Outlook, AOL or a lookalike domain means stop.

2. The hidden tracking pixels

I opened the raw message source and found two invisible images in the HTML. One is a mail-merge tracking pixel and the other is an email-signature tracker. Mail merge means the email went out in bulk from a template with my name filled in. The trackers report back when I open it, which tells the sender my address is live and that I am interested.

An acquisitions editor writing to one author does not use mail-merge tracking.

3. The signature is a free template

The signature icons come from a free online email-signature generator. There is no phone number, no office address and no institutional footer, only a Gmail address and a link to the real MIT Press homepage, borrowed for credibility.

4. The praise is just the table of contents

Every specific compliment (Battleship, Pac-Man with Canvas, HTML and CSS, debugging, object-oriented programming) can be lifted from the book's public description. Nothing in the email shows anyone read it. That is typical of a templated or AI-written scam message: personal enough to flatter, generic enough to send to thousands of authors.

It also did not fit. A university press known for scholarly and trade work in computing does not usually cold-pitch the author of a ten-year-old kids' coding book from another publisher.

5. The "Do you have an agent?" hook

This is the giveaway. Writer Beware, which tracks scams aimed at authors, has documented a wave of these emails through 2026. A fake editor from a real publisher praises your work and asks if you are represented. Once you reply, the "editor" recommends one of their "trusted" literary agents. That agent then needs you to pay for editing, a query-letter rewrite, a "manuscript evaluation" or marketing. Reported fees start in the thousands of dollars.

Real publishers and agents do not charge authors. Money moves to the writer.

6. The person isn't findable

I searched for the name on the email at MIT Press and found nothing. That does not prove nobody by that name works there, but it fits the pattern: these scams use either invented names or real editors' identities with fake addresses. Either way, the way to check is the same.

How to investigate an email yourself

You do not need special tools. Most of the evidence is already in the message, one click below the surface.

1. Open the full headers

Every mail client can show the raw message:

Gmail: open the email, click the three dots, then Show original.
Outlook (desktop): File, then Properties, and read Internet headers.
Apple Mail: View, then Message, then Raw Source.

You will see a wall of text. You only need a few lines.

2. Read the authentication results

Look for a line starting Authentication-Results:

Authentication-Results: mx.google.com;
  spf=pass smtp.mailfrom=gmail.com;
  dkim=pass header.d=gmail.com;
  dmarc=pass header.from=gmail.com

Three checks: SPF (was the sending server allowed to send for this domain), DKIM (is the message signed by this domain) and DMARC (does it all line up with the From address). Read the domain after each "pass".

A pass only proves the message really came from that domain. A scammer's own Gmail account passes all three. What matters is whether the domain is the organization it claims to be.

3. Compare From, Reply-To and Return-Path

If the From says one organization but Reply-To or Return-Path points somewhere else, your reply will not go where you think it will. A mismatch is a red flag.

4. Follow the Received lines

Each server adds a Received: line at the top, so read from the bottom up. The lowest one is where the message started. A message that claims to come from a university press but first appears on a consumer mail service or an unrelated hosting provider has told you what you need to know.

5. Inspect links and images without clicking

On a computer, hover over a link and read the address in the corner of the window. On a phone, press and hold.
Be suspicious of link shorteners and of domains that are almost right (mitpress-editors.com, rnitpress.com).
In the raw HTML, search for <img. A 1x1 image, or one whose address carries a long code, is a tracking pixel.

6. Check the domain's age

Search the domain in a WHOIS or RDAP lookup. Real organizations' domains are usually years old. A domain registered last month and pretending to be a publisher is a scam.

7. Search the exact wording

Put a distinctive sentence from the email in quotes and add "scam". Pattern scams leave a trail: forums, author groups and Writer Beware often have the same text already.

8. Confirm through a channel you control

Do not use the links or phone numbers in the email. Find the organization's official contact page yourself and ask whether the person exists and wrote to you. If the answer is no, forward the message to them. Many publishers collect these reports.

9. Report it, then stop

Mark it as phishing in your mail client and delete it. Do not reply to say no. A reply confirms your address is live.

How to verify an offer like this

Check the domain, not the display name. Read the actual address, and the authentication results if your client shows them.
Go to the source yourself. Open the publisher's website directly (not through the email), find the acquisitions or contact page, and ask whether the person exists.
Do not reply to the original thread.
Search the pattern. Writer Beware keeps a running list of impersonation scams.
Never pay to be published, agented or "evaluated" because of an unsolicited email.

Why authors of technical books get targeted

If you have published with Packt, O'Reilly, Manning, Apress or similar, your name, book descriptions and often your contact details are public and easy to scrape. That is enough for a template to produce a convincing, personal-looking email. I have written three books, so I am in those datasets. If you have written even one, you probably are too.

I reported the email as phishing and moved on. If something similar lands in your inbox, do the same. And if you do want to publish with a university press, write your proposal and send it to the editor yourself. That is how the real process starts.

Further reading:

Writer Beware: The First Clue to an Email Scam May Be the Address
Watch Out For This Scam Impersonating Editors at Major Publishing Houses (Victoria Strauss, for Writer Beware)