Domain Renewal Scams

Domain renewal scams send official-looking notices — by email, letter, or online form — claiming that your website's domain name is about to expire, and urging you to renew it with the sender immediately to avoid losing it. The sender is not your real domain registrar. Depending on the variant, the fraud either extracts a fee for a worthless or non-existent renewal, or — more seriously — tricks you into initiating a domain transfer that moves ownership of your domain to the fraudster's account.

Domain names are often mission-critical business assets. Losing or accidentally transferring a domain can take a website offline, disrupt email, and cause significant reputational and commercial harm. Scammers exploit this anxiety by creating urgency: 'expires in 5 days', 'final notice', 'act now to prevent loss of your online presence'.

Because domain registration records (WHOIS data) were historically public, fraudsters could easily identify domains, their expiry dates, and contact information. Even with WHOIS privacy becoming more common, large volumes of business email addresses are publicly available, and domain names are easily scraped from websites. This makes targeting straightforward, and the fraudster does not need to know who your real registrar is to send a convincing notice.

The scammer identifies domains (by scraping websites, purchasing lists, or using WHOIS lookup tools) and sends notices to the contact email on record — or to the business's general email address — from a company with a registrar-sounding name. The notice is formatted to resemble a genuine domain management email, complete with domain name, expiry date (often accurate, if scraped), and a prominent payment link or bank transfer instruction.

In the fee-extraction variant, the victim pays a renewal invoice — typically at an inflated rate — to a company that either does nothing, or registers the domain in their own account without proper transfer of ownership to the victim. The victim believes their domain is secure; in fact, the situation may be worse than before.

In the domain-transfer variant, the notice includes a form or link that, when completed or clicked, initiates a registrar transfer request from your real registrar. Once you 'confirm' the transfer through what appears to be a routine renewal process, your domain moves to the fraudster's registrar account, where they can hold it for ransom, let it lapse, or use it maliciously.

Some variants target domain owners nearing the end of a redemption period (after the domain has already lapsed), offering to recover it for a large fee — then taking the money without acting.

Domain renewal scams are effective because the stakes feel high and the action requested is familiar. Everyone who owns a domain knows it needs renewing. When a notice arrives with your actual domain name and a realistic-looking expiry date, the emotional trigger — 'I might lose my website' — is immediate and powerful.

The fraud also exploits the transactional nature of domain renewals. Most domain owners renew by clicking a link and paying a fee; there is nothing unusual about receiving a renewal notice and following up. The difference between a real notice and a fake one is the sender's identity — a detail that is easy to miss in a busy inbox.

For organisations where the domain is managed by a junior administrator or is registered under a personal email address, there may be no clear internal record of which registrar holds the domain, making it harder to immediately identify a fraudulent notice.

A small business receives an email saying their domain expires in three days. The notice is formatted like a professional registrar email and shows the correct domain name and a realistic-looking expiry date. The business manager, worried about losing the website, clicks the link and pays a renewal fee. They receive a confirmation. Several months later the domain fails to renew properly, or the manager discovers the domain is registered with a company they have never heard of. Their original registrar still holds the record and the renewal payment accomplished nothing.

FINAL NOTICE: your domain [domain name] expires in 5 days. Renew immediately with [company name] for [amount] to maintain your online presence.

ACTION REQUIRED: [domain name] is due to expire on [date]. To prevent interruption to your website and email services, please confirm renewal using the link below.

This is your final opportunity to secure [domain name] before it becomes available to the public. Renew now for [amount] to retain exclusive ownership.

Your annual domain registration for [domain name] is due. Please transfer [amount] to the account below to process your renewal for the next 12 months.

We have detected that [domain name] is approaching expiry. As an authorised domain service provider, we can renew it on your behalf for [amount]. Please complete the form to confirm.

URGENT: If you do not renew [domain name] within 48 hours, it will enter the public release pool. Secure it now for [amount] to avoid losing your domain.

The only reliable way to check your domain's status is to log in to your actual registrar's account directly — not by following any link in an unsolicited email or letter.

- Identify your real registrar: check the account where you originally registered, review your email archive for registration confirmations, or use an official WHOIS lookup (e.g. your country-code registry's own lookup tool) to find the listed registrar. - Log in directly: go to your registrar's official URL by typing it into your browser. Check your domain's actual expiry date in your account dashboard. - Never click renewal links in unsolicited emails: type your registrar's web address directly or use a saved bookmark. - If you receive a renewal notice from an unfamiliar company, do not complete any forms they provide, as this may initiate a transfer request. - Set up automatic renewal with your real registrar to eliminate the window of opportunity these scams exploit. - Enable domain lock (registrar lock) on your domain — this blocks transfer requests unless you explicitly remove the lock in your own account.