How do you spot a fake domain or website renewal notice?
Treat any renewal notice you did not expect as unconfirmed until you check it yourself. Fake ones often come from a company you do not use, warn that your site or email will go dark, and push you to pay through their link or number. Do not pay from the notice or click its links. Type your registrar's address yourself, log in, check the expiry date there, and report fakes at ReportFraud.ftc.gov.
Signs a notice may be fake
- It comes from a company that is not the one you pay for your domain or hosting.
- It sets a short deadline and warns that your website or email will stop working.
- It asks you to pay through a link, a phone number or a return slip in the notice itself.
- The sender's address is close to a real company's but not quite the same.
- It looks like a bill, but the small print can show it is an offer, sometimes to move your domain to a different company.
What ICANN says
ICANN, which coordinates domain names, warns registrants in a blog post by Brian Gutterman (30 April 2020) that phishing emails "may claim that your domain name registration needs to be renewed" and that you must pay a fee. It says these messages typically forge a trusted sender's address or use a look-alike domain, and typically ask the reader to reply, call a number, click a link or open a file.
The same post says ICANN "never requests payment of fees from registrants" and does not send domain expiration reminders or renewal requests. Its advice is to contact your sponsoring registrar directly about any concern over your domain's status. ICANN's "About Phishing" page adds: do not enter your password on a page you reached through a link in an email.
How to check with your own registrar
- Find your registrar from your own records, such as a past receipt or card statement, not from the notice. The related answer on who should own your domain name explains how to look it up.
- Type the registrar's web address yourself, log in, and check the expiry date and auto-renew. If unsure, call the number on its own website.
- If the notice does not match anything in your account, it is not your bill.
- The FTC's small business guide (July 2023) says to set clear procedures for approving purchases and invoices and to have staff check all invoices closely. As general advice, have whoever pays bills check with the owner before paying any domain or website invoice.
If you already paid or logged in
As general advice, call your bank or card company at once and change your registrar password. ICANN's 2020 post also recommends, as general protection, turning on multi-factor authentication if your registrar supports it, and asking your registrar for a "registrar lock" to help block unwanted changes or transfers.
Where to report it
Report it at ReportFraud.ftc.gov or to your state Attorney General; the related answer on how to spot spam and scam inquiries has the details. ICANN's "About Phishing" page says phishing complaints are outside its scope and points to law enforcement, consumer protection bodies such as the FTC, and the phishing domain's host or registrar; it asks that messages using ICANN's name be reported to ICANN. Fake invoices and other scams that reach your inbox are covered in the related answer on how to spot spam and scam inquiries.
Sources
- ICANN, Brian Gutterman, "Do You Have a Domain Name? Here's What You Need to Know." (30 April 2020)
- ICANN, "About Phishing"
- Federal Trade Commission, "Scams and Your Small Business: A Guide for Business" (July 2023)
Related answers
- How do you spot spam and scam inquiries from your website?
- Who should own your business's domain name?
- What does looking after a small business website involve?
Websites, upgraded or built
Most businesses do not need a new website. They need the one they have to load fast, say clearly what they do and ask the visitor to take one step.