It was not the first time this email arrived. Again, shortlisted as Top Cloud Infrastructure Services in Latin America 2026. Again, the 132,000 subscribers, the sole organization of the edition, and the price buried mid-text: reprint rights, logo, and benefits for a nominal fee.
This time, the email became forensics. And the forensics dated the script: the same text has circulated for seven years, with a price table, complaints, and a selection proof that dismantles itself.
The script, dated source by source
The CIO Review case has a complete paper trail:
- Trustpilot, since 2019: complaints with the same script.
- LinkedIn, 2020 and 2021: CISOs posting the same 3,000 dollars being charged.
- Hacker News, 2022: the whole list cataloged, with the table: CIO Review, CIO Applications, Enterprise Security, and MyTechMag at 3,000 dollars each, Industry Era at 1,800, Enterprise Tech Success at 1,000.
- April 2026: a telecom competitor received the same pitch, with another title and the same sole honoree, from the same Fort Lauderdale address.
And the selection proof that dismantles itself: one company was awarded Top 10 Dell without working with Dell. If every honoree receives the same text for seven years, nobody was selected.
The mechanics: phishing in a suit
The magazine publishes for real; what is sold is the seal, wholesale. The BBB records monthly 3,000-dollar requests, and in the Latin America edition the script repeats with its own domain and requests for confidential data under the pretext of a profile.
The mechanics are phishing with executive varnish, in five layers: flattery with the company’s name, borrowed authority from real CIOs, fabricated scarcity (sole organization of the edition), the price buried mid-text, and the closer on the call with a senior manager nobody heard of.
It does not steal passwords, does not install payloads: it charges 3,000 dollars for the seal. And it monetizes the vanity of whoever needs a credential more than an audit.
The real cost is not the 3,000 dollars
The financial hit is the cheap part. The serious cost comes later: the bought seal enters the website, the signature, the proposal. And the first serious due diligence (from a bank, an enterprise client, an investor) finds the framed certificate, searches the publication’s name, and finds the 2019 Trustpilot.
A bought seal displayed as editorial merit is a reputational liability with a frame. In the United States, the FTC’s paid-endorsement rule requires clear, visible disclosure of unexpected financial connections: a bought seal presented as merit is exactly the case the rule targets.
The reverse checklist (for the seals already on the wall)
The same test works backwards: list the awards and seals the company displays today and verify three things: who publishes them, who paid for the recognition, and who else received the same one that year. It is the same spirit as auditing the periphery: the surface nobody examines is the one accumulating the liability.
At Tech86, trust is the product, and a bought seal is reputational debt that matures at the first serious due diligence. I ignored the email again and turned it into forensics.
Conclusion
The rule of thumb fits in one line: an award with a price in the email is not an award, it is an invoice with varnish.
Phishing evolved into suits and swapped passwords for seals. The antidote is the usual one: ten minutes of verification (Trustpilot, LinkedIn, Hacker News, BBB) before replying, and an honest audit of the seals already on the wall. Your client’s first serious due diligence says thank you.