Domain Renewal Scams on Microsoft Teams
Attackers use Microsoft Teams chats to impersonate IT or a registrar and warn that a domain is expiring, pressuring staff to pay or share login details.
Part of: Domain Renewal Scams
Last reviewed: 1 June 2026
Domain renewal scams can reach staff through Microsoft Teams, where a chat warning that a company domain is about to expire feels internal and urgent. A message appearing to come from IT or a registrar contact can prompt a quick response without the verification a formal notice might invite.
The informal, trusted feel of Teams reduces scrutiny. A compromised account or an external guest using a recognisable name can warn of an imminent expiry and direct staff to pay a fee or enter registrar login details on a linked page.
How this scam works on Microsoft Teams
The attacker messages staff through Teams posing as IT, a colleague, or a registrar contact, stating that the company's domain is expiring and that immediate action is needed to avoid losing the website and email.
They provide a payment link or direct the recipient to a page that captures registrar login details, stressing an urgent deadline. The chat context and apparent internal source discourage independent verification.
If staff pay or enter credentials, the money funds an unrelated party or the attacker gains access to control the domain. The genuine domain may remain unaffected, and captured credentials expose the business to further compromise.
Common red flags
- A Teams chat warning that a company domain is about to expire
- An external-guest account using a known IT or registrar name
- A payment link or login page sent in chat
- Urgency framed around losing the website and email
- A login page whose address differs from your real registrar
- A fee higher than your normal renewal cost
How to protect yourself
- Verify expiry claims by logging in to your known registrar directly
- Do not click renewal links or enter credentials from a chat message
- Confirm with your IT team through an official channel
- Record your renewal dates to recognise false claims
- Enable multi-factor authentication on your registrar account
- Restrict and label external-guest access in Teams
How to report it
- Report the impersonating or compromised account to IT security
- Notify your genuine registrar of the impersonation
- File a report with your national cybercrime or fraud centre
Frequently asked questions
Someone in Teams says our domain expires today and sent a renewal link. Is it real?
Be cautious. A compromised account or guest can send such a warning. Do not click the link; log in to your registrar directly to check the renewal date, and confirm with your IT team through an official channel.