"Per our records, your annual Vendor Credentialing Fee is now past due. To keep your vendor status active, please complete and return the attached Credit Card Authorization Form by end of business Friday."
Here's a hypothetical, and everyone in it is made up. Rosa runs Kettle Ridge Janitorial Supply (a made-up company) out of a rented bay behind a tire shop. Last spring she landed her first federal order: floor wax and mop heads for a regional office, $38,000 over a year. It took her eight months, two rejected bids and one very long weekend inside SAM.gov, the government's free vendor registration site, to get there.
So when the email landed at 3:52 PM on a Thursday, she didn't flinch. It was signed by a real contracting official at the General Services Administration, the agency that runs federal buying. Real name. Real title. The agency seal in the signature block. A clean two-page PDF: "Annual Vendor Credentialing Fee, $1,295.00," with a line for her card number, the expiration date, the three-digit code on the back and her signature.
The MCA debit had taken $611 that morning. The card had room. She filled in the form, scanned it on the printer by the coffee maker and hit reply.
Here's the turn. The name was real. The title was real. The address wasn't. It ended in e-gsa.us, not gsa.gov. And the fee doesn't exist.
This is live right now. On Oct. 28, 2026, GSA's Office of Inspector General, its internal watchdog, warned that scammers are impersonating real GSA officials and emailing contractors, including Multiple Award Schedule holders and companies registered in SAM.gov (GSA OIG). The OIG says it has received multiple reports in recent weeks. It describes two versions so far. One is a fake "Vendor Credentialing Form" claiming an annual fee is due to keep your status active, with a credit card authorization form attached. The other is a fake "Records Digitization Non-Compliance" notice saying your contract file was flagged and pointing you to an attachment for "resolution steps." The OIG named e-gsa.us as one look-alike domain used in reported cases and warned there may be others.
GSA's own guidance says registering, renewing or "fixing" a SAM.gov registration is always free, and that any email asking for money to do it is not from the government (GSA).
Red flags
- A real official's name and signature block. That proves nothing. The OIG says scammers copy them on purpose (GSA OIG).
- The sender's domain isn't exactly gsa.gov. Hover over the name and read the full address. Watch for extra letters, dashes or a different ending (GSA OIG).
- Any "fee" tied to your vendor status. GSA says the government never charges to register, renew or fix a SAM.gov registration (GSA).
- A form asking for your full card number and security code, or an attachment you didn't ask for (GSA OIG).
- A "non-compliance" flag with a deadline and "resolution steps" in an attachment (GSA OIG).
What to do
Don't reply, don't open the attachment and don't send card details. Sign in to SAM.gov yourself, not through a link in the email, and check your registration status there (GSA).
If you have a GSA contract, call or email your contracting officer using contact details you already have or can confirm on your own, never the ones in the suspicious email. Tell them their name is being used (GSA OIG).
Keep a copy of the email, including the headers if you can. Report it to the GSA OIG hotline and to the FBI's Internet Crime Complaint Center (GSA OIG). You can also file at the FTC's fraud report site.
Already sent the form? Call your card issuer right away, dispute any charges you don't recognize and ask for a new card number.
Rosa's phone buzzed at 9:14 that night. Her card company wanted to know if she'd just spent $2,480 at an electronics store in another state. She hadn't. She was still sitting at the desk, staring at the form, trying to remember where the $1,295 had gone.
