Scam library · Small business · Email & phishing
Fake domain name renewal notice scam
A notice that looks like an invoice says your domain, like yourbusiness.com, expires soon. Pay now to avoid losing your website and email.
The company isn't your current registrar. If you pay, you may be agreeing to transfer your domain to them at a much higher price, or you may just be paying for nothing.
What the message looks like
From: Domain Services Renewal <notice@domain-registry-services[.]net>
Subject: FINAL NOTICE: yourbusiness.com expiration
Your domain yourbusiness.com will expire in 3 days. Failure to renew will result in loss of your online presence.
Renew now for 5 years: $389.00. Sign in to your account to confirm.
How this scam works
This is sometimes called 'domain slamming'. The notices are carefully worded so they look like bills, with due dates and account numbers. In the fine print they say it's a solicitation, not an invoice.
Email versions are phishing: they link to a fake registrar login page. If you sign in, scammers can take over your domain, which controls both your website and your business email.
A similar trick is a notice from an 'Asian domain registration' firm saying someone wants to register your brand name in other countries and you need to act now.
Losing control of a domain is serious. Whoever controls it can read password-reset emails, take down your site, or send email as you. That's why it's worth a few minutes to check who your real registrar is and to keep the account locked down.
Red flags
- A renewal notice from a company you don't remember using.
- 'Final notice' or claims your site and email will be lost.
- Fine print saying it's a solicitation, not a bill.
- Much higher prices than your usual renewal.
- Links to sign in to an 'account' to renew.
How to tell it’s fake
- Check who your real registrar is and the expiration date using an ICANN lookup or your records.
- Sign in to your registrar directly, not through a link in the email.
- Turn on auto-renew and registrar lock.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- Don't pay or reply. Report phishing emails to your registrar and ReportFraud.ftc.gov.
If you paid
- If you paid, contact your card issuer to dispute it, and check whether a transfer was started.
If you shared personal info, a password or a code
- If you signed in on a fake page, change your registrar password, turn on two-step verification, and make sure the domain is locked.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome and Edge on your computer checks renewal emails you have open in Gmail or Outlook on the web. It spots fake registrar login pages and invoices from companies you've never used, before you pay or sign in. If a notice seems legit, a quick expert check protects your website and email.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- How do I find my real registrar?
- Use an ICANN lookup or check past receipts. Your registrar sends renewals to the email on file.
- Is a mailed domain notice a scam?
- Often it's a solicitation that looks like a bill. Read the fine print and check with your current registrar.
- What if my domain was transferred?
- Contact your original registrar right away. Transfers can sometimes be reversed if reported quickly.