Something feels off about a potential windfall client, but I haven't found a solid reason to not pursue it. Seems too good to be true.

OK here's the rundown:

• We received a contact form submission through our website from someone on behalf of a company asking about running Google Ads campaigns for them.
• The company name they left is not only legit, they've been around for decades and have a Wikipedia page and are worth a ton.
• The person's name is legit and listed on their website and LinkedIn.
• BUT the phone number they left didn't connect. They had asked to be contacted by email in the message and they responded to email within an hour.
• BUT the email they left and are using is kind of weird. Instead of name[at]companyname.com it's something like vendors[at]companyname.marketing. I checked Whois records on companyname.marketing and it said it was taken but gave me no other info.
• Her replies have been very formal and somewhat curt. I offered - as always - to schedule a time to go over what they're looking for, give her info on our company, etc. but she wants to just give us read-only access to their account so we can look at their campaigns first and see if we think we'd be a good fit. I don't really see a point in this at this stage (I assured her we've worked on these types of campaigns and in their industry extensively) but OK, we can take a look. She said after we check it out, if we want to move forward, then we can schedule a call for next week, and she sent her Calendly link.
• So far, she hasn't sent any strange links or attachments or asked for anything other than an email address to send the read-only invitation to. Obviously if we move forward we'll want access for our MCC but I haven't bothered bringing that up yet.

She claims they spend $150k/month in Google Ads. At that level, we charge percentage of ad spend, so this would be a very large client for us.

I've been in this game for many years, and clients that want to spend that much don't usually just drop in your lap and ask zero questions before giving you access to anything. The weird email address and phone number are the biggest red flags so far, but I don't see a reason yet to disengage.

Something is off, but if it is, I can't see what a potential scammer would be getting at? Anyone see something I don't?