Domain Scams and Fake Renewal Notices: How to Spot Them
A fake domain renewal notice is an email, letter or phone call that looks like an invoice for your domain from a company you do not use. Paying it sends money to a scammer, and signing the form that comes with it can even move your domain away from you. The defence is simple: only the company you registered the domain with can renew it, so check every notice against your own account before you do anything.
In short
- Check the sender. A real renewal notice comes from the company you registered the domain with.
- Check the invoice in your account. A real renewal has a matching invoice in your console.
- Never share a code or a password. No renewal needs your authorisation code or your login.
- Pressure is the tell. Fake notices create a deadline and a threat.
- If you paid, act the same day. Call your bank, secure your accounts and tell us.
What is a domain renewal scam?
A domain renewal scam is a notice that asks you to pay to renew, register, protect or list a domain with someone who has no relationship with you. The scammers collect names from public records, then send a convincing invoice that mentions your domain, an amount and a deadline. Scams like this are sent worldwide, to businesses of every size.
What are the common domain scams?
| Scam | What you receive | What it wants |
|---|---|---|
| Fake renewal invoice | A letter or email billing you for your domain from a "registry" or "domain service" | Your payment, to a stranger |
| Registrar switch | A "renewal" form that, once signed, authorises a transfer to another registrar | Your signature or your authorisation code |
| Expiry warning | An email saying your domain is about to expire, with a link to "renew now" | Your registrar login, on a lookalike site |
| Overseas "brand" alert | An email from an agent saying someone wants to register your name under another country's ending | A fee to "protect" the name |
| Directory or SEO invoice | An invoice for a listing or a search service you never ordered | A payment |
| Changed bank details | A real-looking invoice with new payment details | Your payment, to a new account |
Business email compromise, where the thief poses as a supplier, is the same idea. How to tell a real email from a fraudulent one shows what to look for in the message itself.
How do you spot a fake renewal notice?
Ask five questions:
- Do you know this company? If you never registered your domain with it, it cannot renew your domain.
- Does the sender match your registrar? Compare the sending address and the website with the company on your invoices.
- Is there an invoice in your console? A real renewal is an invoice under Billing > My Invoices.
- Is it rushing you? "Pay within 24 hours or lose your site" is a pressure tactic. A real renewal has an invoice issued ahead of the renewal date, and a reminder before the name expires.
- Does it ask for something it should not? A real renewal never needs your console password, your authorisation code or a signed transfer form.
Your registrar warns you before a domain expires. For a .com or other generic name, ICANN's rules require two reminders before expiry, about a month and a week ahead, and another soon after. So a stranger's "final warning" is not how renewal works.
Why are these scams hard to ignore?
They use real facts: your domain name, your registrant's name and the right expiry month. That information is easy to collect, so a notice can look authentic. The pressure, and not the detail, is what to judge.
How do you check whether a domain is yours?
Do the checks yourself, never through a link in the notice:
- Log in to the console by typing the address, or from your bookmark, and open Domains > My Domains.
- Read the expiry date and the status. Auto Renew should be on.
- Open Billing > My Invoices and look for the renewal invoice.
- Look up the domain with ICANN Lookup for a .com or other generic name, or the ZARC WHOIS for a .co.za name, to see the registrar of record.
If the domain, the date and the invoice are all fine, the notice was a fake.
What do real Noiz renewal notices look like?
A genuine Noiz reminder arrives by email from a Noiz address before the renewal date. It matches an invoice in your console, and it can carry a link to switch off renewal if you do not want the name. If you are ever unsure, ignore the link and log in to the console yourself. We never ask for your console password. We give out an authorisation code only when you ask for one, in your console or by email to the registrant address. What happens when a domain expires shows the whole renewal process.
What if you have already paid, signed or clicked?
Act the same day:
- Paid. Call your bank and ask whether the payment can be recalled. Keep the notice and the proof of payment.
- Signed a transfer form or shared a code. Open a ticket straight away, and we will tell you what can still be done. Why a domain transfer fails shows how transfers are approved.
- Entered your password on a link. Change it everywhere you use it, switch on two-factor authentication and review your account. Has your account been hacked? The signs to look for lists what to check.
- Told no one yet. Tell your team, so nobody pays a second notice.
How do you protect your domain?
- Keep the registrant details yours, with an email address you read.
- Keep the registrar lock on unless you are moving the domain.
- Turn on two-factor authentication on your console account.
- Keep Auto Renew on, so a notice cannot rush you.
- Tell your team that renewal invoices come only from your registrar, and pay only from the console.
Domain transfer checklist for South African businesses covers who controls a domain, and What is a domain name? explains the basics.
Get a second opinion
Forward any notice you are unsure of to [email protected], or open a ticket in the console, and we will tell you whether it is real. Domain renewals and transfers follow the registry rules and our Specific Terms.
Read next
- How to tell a real email from a fraudulent one
- What happens when a domain expires
- Has your account been hacked? The signs to look for
Sources
- ICANN: Expired Registration Recovery Policy: the reminders a registrar must send.
- ICANN: Transfer Policy: what a generic transfer needs.
- ZARC: Registrant voting procedure: how a .za transfer is approved.
- ICANN Lookup: the registration data tool.
- ICANN SSAC: A registrant's guide to protecting domain name registration accounts (SAC044): how domains are stolen and how to stop it.
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
