If we start checking out every new inquiry, won't we look paranoid and lose real customers?

This is the right worry to have. Responding fast to a potential customer is how small businesses win work, and nobody should train that instinct out of their team. The scam that targets your quote inbox works precisely because the instinct is a good one.

The fix is placement, not suspicion. Reply quickly, be friendly, say you would be glad to take a look. Then, before you spend real time on it, ask a few ordinary qualifying questions. Where is the site, what is the timeline, who would we be invoicing. None of that reads as paranoia to a genuine buyer, because those are the questions any competent vendor asks anyway.

What you are protecting is not the reply. It is everything expensive that comes after it: a written quote, a scheduled meeting, a document you open, a link you click. That is where the loss actually happens, and it is also the point where a real customer is perfectly happy to answer questions.

Watch what happens when you ask. A real buyer answers easily, because a real buyer wants the quote. Someone running a scam either stays vague, gets pushy about scheduling a call, or goes quiet. That difference is usually visible within one exchange.

Ten minutes on a real lead costs you almost nothing. Ten minutes on a fake one ends it. The math only looks bad if you picture the check as a wall in front of your inbox instead of a step in the middle of a conversation you were already going to have.