Fake Domain Renewal Notices: How to Tell, and What to Do

Anyone who has had a website for a few years has received one of these, and the good ones are convincing: your domain name, your address from the public record, a due date and an amount. They work because a lapsed domain takes the website and the email with it, and nobody remembers when theirs is due. This page covers the two types we see most, the checks that tell them apart from a real notice, and what to do. The fuller picture of what a domain is and who holds it is in Who Owns Your Domain?.

The two types

The renewal that is a transfer

The classic is a mailing that looks like an expiry notice or an invoice from your current registrar. The FTC described this in a 2003 complaint against a Canadian reseller of domain services: millions of mailings captioned “IMPORTANT NOTICE”, made to look like renewal notices or invoices from consumers’ current registrars, urging quick action to avoid “Register Lock” or “loss of your online identity”¹. The FTC alleged that consumers who paid believed they were renewing with their current registrar and were actually transferring the registration to the sender’s registrar, and that a $4.50 processing fee for incomplete transfers was not disclosed¹. The company agreed to a settlement order that barred misleading representations, without admitting a violation.

That case is more than twenty years old, and it describes the mechanism exactly: the letter is a sales document in the shape of a bill, and paying it starts a transfer, not a renewal.

The invoice for a service you never ordered

The second type is simply an invoice. The FTC’s May 14, 2026 alert says these often start when someone on your staff gets an unexpected or unfamiliar invoice in the mail, and that the invoices may mention tech support, domain registration or search engine optimization². Some imitate well-known companies, some come from unfamiliar senders, and some carry “past due” notices to create urgency. A “listing” or “search engine submission” invoice is in this group: it bills for something you did not order.

When the notice arrives by email, the FTC adds a second risk: fake invoices sent by email are often phishing attempts aimed at your business data and networks. In that case the danger is the link or the attachment as much as the amount.

Four checks that tell them apart

Then check the facts, in this order:

1. Look up your registrar. Use ICANN’s free lookup, which shows registration data from the registrar and the registry. The registrar named there is the only company that can legitimately bill you to renew.
2. Log in to that registrar directly. Type its address yourself; do not use a link in the notice. Read the expiry date and whether auto-renew is on.
3. Compare the sender with the registrar. A different name is the answer.
4. Search the sender’s name. The FTC advises researching an unfamiliar company by searching its name with words such as “review”, “scam” or “complaint”.

A genuine expiry notice has a known source. ICANN’s policy says registrars must notify the registrant at least twice before expiry, about a month and about a week ahead, and send at least one more if the name is not renewed or deleted within five days after expiry, in a way that needs no action to receive, such as email³. If the first you hear of an expiry is a letter from a stranger, the registrar’s record, not the letter, is the one to trust.

What happens if someone pays one

The transfer policy requires the gaining registrar to obtain express authorization from the registrant or the administrative contact, through a standardized form, and says a transfer must not be allowed to proceed if no confirmation is received. A notice that you pay or sign without reading can still be the request that starts a transfer, which is what the FTC alleged in the 2003 case¹. The practical risk is therefore a reply: confirming a transfer you did not start.

If you have already paid, the steps are:

• Tell your registrar now, and ask what is pending on the domain.
• Do not confirm any transfer email you did not start yourself.
• Contact your card issuer about the charge.
• Report it, as below.

What to do with one that arrives

1. Do nothing with it. Do not call the number, click the link or reply. If you have to open an email, do so without downloading attachments.
2. Do the lookup and the login above, so you know your real expiry date. Write it down.
3. Report it. The FTC says to report fake invoices and other scams at ReportFraud.ftc.gov, and to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.
4. Tell whoever pays the bills. The FTC’s advice for businesses is to make the company’s procedures for approving invoices clear, and to approve only invoices from vendors you actually work with. A paper notice that reaches the front desk can end up in an accounts pile; a rule that no domain invoice is paid without checking the registrar prevents it.

How to make them harmless

The notices keep coming; what changes is whether they work. Four habits take their force away:

• One registrar for all your domains. A single login, with one renewal list, makes a notice from anyone else stand out.
• One card, on auto-renew. ICANN lists keeping payment information current for automatic renewal among the registrant’s responsibilities. If the real renewal takes care of itself, a “final notice” has nothing to say.
• The record in the owner’s name, with an email address a person reads. The registrar’s real notices go to the registrant, and the address on the record is also how it reaches you.
• The renewal date written down where the owner keeps it, not only in a designer’s inbox.

What we do about it

On the sites we manage, domains are registered in the client’s name with the client’s email on the record, and the registrar, the expiry date and the auto-renew setting are on the one page the owner holds. When a client forwards a notice and asks whether it is real, the answer is the lookup and the login described above, and it takes minutes. See website management for what is included.

When to get help

If you are not sure which company is your registrar, or the email on the record is a former designer’s, that is the problem to fix, and it is worth an hour of someone’s time. The same applies if you have paid a notice and see a transfer pending. The consultation is free.

Frequently Asked Questions

Is a letter saying my domain is about to expire a scam?

It can be. If the sender is not the registrar where you registered the domain, it is a solicitation, and the FTC’s 2003 case describes mailings that looked like renewal notices from the consumer’s current registrar and were in fact transfer requests¹. Check the expiry in your registrar account.

How do I know who my registrar is?

Look the domain up in ICANN’s lookup, which shows the registrar as part of the registration data it returns. Your card statement for the domain also names the company you pay.

What if I already paid the notice?

Tell your registrar, do not confirm any transfer email you did not start, and ask your card issuer about the charge. A transfer cannot proceed without confirmation from the registrant or the administrative contact.

Where do I report a fake invoice?

The FTC says to report fake invoices and other scams at ReportFraud.ftc.gov, and to forward phishing emails to reportphishing@apwg.org.

Do real registrars warn me before a domain expires?

Yes. ICANN’s policy requires at least two notices before expiry, about a month and about a week out, and at least one more after, if the name has not been renewed or deleted within five days³.

Can the sender really take my domain if I ignore the letter?

The FTC describes these invoices as bills for things a business never ordered, and a transfer needs confirmation from the registrant or the administrative contact. For a question about your own case, ask a licensed professional.

Sources