Domain renewal scam letters and emails

Most letters and emails that warn your domain is about to expire, and ask you to pay a company you have never heard of, are not from the company that actually holds your domain. Some are a sales trick to move your domain to a pricier registrar, some are invoices for a service you never ordered, and some are phishing pages built to steal your login. Your real renewal comes from your own registrar, and you can always confirm it by logging in on their website yourself.

The kinds you are likely to see

The paper "renewal notice"

It arrives by mail, looks like a bill, has your domain name, an "expiration date" and a payment slip. The small print says something like "this is not a bill" or "by returning this form you authorize the transfer of your domain". Paying it does not renew your domain where it is: it starts moving it to the sender, usually at a much higher yearly price. This practice is often called domain slamming. The letters are carefully worded so that, technically, they are an offer.

The fake listing or "search registration" invoice

An email or letter titled something like "Domain Search Engine Registration" or "Annual Website Listing", with your domain, an amount and a due date. It is not a domain renewal at all. You would be paying for a submission to directories nobody uses. Nothing happens to your domain if you ignore it. SEO scams owners should ignore covers this family of offers more broadly.

The "someone wants your name in Asia" email

A message from a "registration center" saying another company has applied to register your business name as a .cn, .asia or similar domain, and asking whether you are the owner and want to protect it first. There is no rival applicant. Replying leads to an offer to sell you a bundle of foreign domains you do not need.

The suspension or payment-failed email

An email that copies the look of a real registrar: "Your domain will be suspended in 24 hours", "Payment declined, update your details". The button goes to a fake login page. If you type your password there, the sender can take over your account, and with it your domain, website and email.

The buyer or appraisal offer

"We have a client interested in buying yourbusiness.com." The catch comes later, when they ask you to pay for an appraisal or a "certificate of value" first. A real buyer does not need you to pay anyone.

How to tell a real renewal from a fake one

Run through these checks before you pay anything that mentions your domain.

1. Find your real registrar. Type your domain into ICANN's lookup tool. The "Registrar" line names the company that holds it. If the letter is from anyone else, it is not your renewal.
2. Check the real expiration date on the same page. Scam notices often show a date months away, or pick an alarming date that does not match.
3. Read the small print. Words like "solicitation", "not a bill", "transfer", "authorize" or "listing service" give it away.
4. Look at the price. If it is several times what you normally pay, that is a warning sign even before anything else.
5. Never use the link in the email. Open a new browser tab, type your registrar's address yourself and log in. If there is really a problem, you will see it there.
6. Check the sender's address. A real GoDaddy or Namecheap email comes from their own domain, not from a free mail account or a look-alike spelling.

Why they know your name and address

Domain registrations have a public record. For years that record showed the owner's name, mailing address, phone and email to anyone who looked, and lists built from those records are still in circulation. Many registrars now hide personal details by default, but an older domain may have been exposed for a long time. Turning on privacy protection cuts down what is published from now on. Domain privacy explains when it helps and when it is not allowed.

If you already paid

Do not panic. Most of the damage can be undone if you move quickly.

• Call your card company or bank the same day. Explain that you paid an invoice that was misleading and ask about disputing the charge.
• Log in to your real registrar and look for any transfer request or notice of a pending transfer. Most registrars email you and give you several days to reject it. Reject it.
• Check that the transfer lock is on. It is a setting in your domain's page that stops it being moved without you. Domain transfer lock explains how to read it.
• If you typed your password on a fake page, change it immediately on the real site, turn on two-step sign-in and check that your account email and phone have not been changed.
• Report it. The Federal Trade Commission takes reports about misleading business mail and phishing. Your registrar's abuse team also wants to know about emails pretending to be them.

Protecting the business from the next one

Scam notices work best in businesses where whoever opens the mail also pays the bills, and nobody is sure who looks after the website. A few habits stop most of them:

• Decide who owns renewals. One person, who knows which registrar you use.
• Write it down where the bills are paid: "Our domain is with Namecheap. We never pay domain letters by mail." Many bookkeepers will thank you for that sentence.
• Turn on auto-renew at your real registrar so there is never a genuine reason to pay an invoice by hand.
• Keep the transfer lock on unless you are moving the domain yourself.
• Use two-step sign-in on your registrar account and your business email.

For a broader list of fake messages about websites, such as fake security warnings and fake copyright complaints, see phishing emails about your domain or website.

What to do this week

• Look up your domain and note the registrar name and the real expiration date.
• Put that one sentence about who your registrar is next to wherever you pay bills.
• Log in to your registrar, confirm auto-renew and the transfer lock, and add two-step sign-in.
• Throw away, or forward to the FTC, any notice from a company that is not your registrar.

If a renewal letter reminded you that the website on that domain has not been touched in years, you can see your site rebuilt first and look at a modern version before deciding anything.