Fake Domain Renewal Notice? How to Tell in 10 Minutes

The letter looks official. It names your domain, gives a date that feels close, and asks for payment before your website and email stop working. Or it is an invoice for search engine submission or a directory listing that nobody in the office remembers ordering. Either way, you are stuck between two bad outcomes: pay a stranger, or ignore a real bill and lose the site. A fake domain renewal notice can carry your real domain name and even your real expiry date, because both are public registration data that anyone can look up. That is why the paper itself can't settle the question. You can settle it with facts you already control, in about ten minutes, before any money moves.

The Ten-Minute Check Starts in Your Real Registrar Account

Before anything else, put the notice down. Do not pay it, do not click its links, and do not call the phone number printed on it, because every one of those routes leads back to whoever sent it. The check below uses only sources you reach on your own. Set a timer if it helps; each step is short.

Minutes 1 and 2: Look up who actually holds your domain

Type your domain into ICANN Lookup and write down two things: the Registrar field and the registry expiry date. ICANN Lookup is the public tool built on RDAP, and ICANN says RDAP replaced WHOIS as the definitive source for registration data on generic domains such as .com, .net and .org in January 2025. If your domain ends in a country code, such as .ca or .co.uk, the lookup may show less, so use the registrar named in your own account records instead.

Minutes 3 to 5: Sign in to the registrar yourself

Open your registrar's website from a saved bookmark or by typing its address. Never use a link from the notice, even if it looks right. Once you are in, find the domain and check its expiration date, whether auto-renew is on, the payment history, the invoices on file, and which email address the account sends notices to.

Minutes 6 and 7: Compare the notice line by line

Now hold the notice next to what you found. Check the company name, the website address, the phone number, the amount and the deadline. A real renewal from your registrar should match your account on every one of those points: the same company, the same expiry date, and a price in line with what you paid last time.

Minutes 8 to 10: Stop, or renew inside the account

If everything matches, renew from inside the account you just opened, not from the notice. If anything differs, do not pay and do not click. Contact the registrar through support details you find on its real website, and ask whether the notice came from them.

That last step is the whole method in miniature. You are not trying to decide whether a piece of paper looks trustworthy. You are checking whether the facts on it match an account you can open yourself.

A Different Company Name Calls for a Question, Not a Payment

Sometimes the notice comes from a company that is not the registrar ICANN Lookup shows. That mismatch is a strong reason to stop, but on its own it does not prove fraud. Some businesses buy domains through a reseller, such as a web host or a designer's account, and a reseller can send genuine notices under its own name. The test is whether you can connect the sender to your registrar through a relationship you already know about.

The host row catches a lot of people out. Your domain registration and your website hosting are two different services, and they may sit with two different companies. If you are unsure which is which, find out now, while nothing is urgent.

Fake Renewal Notices Come in Three Shapes

These notices are not all trying to do the same thing. One wants your payment, one wants your domain, and one wants your password. Knowing which shape you are holding tells you what could go wrong and what to protect first. The FTC and ICANN have each described these patterns in their own guidance.

The renewal that is really a transfer

This is often called domain slamming. The notice reads like a renewal, but signing and paying it moves your domain to a different registrar. The FTC's 2003 enforcement record documented mailers that looked like expiration notices while the fine print described a transfer. Paying one of these does not keep your current registrar; it can hand your domain to a company you never chose.

The fake registrar login

This one arrives by email. It warns that your domain is expiring or your account has a problem, and it links to a page that looks like your registrar's sign-in screen. ICANN's security committee described this pattern in its advisory on registrar impersonation: the fake page collects your username and password, and whoever holds them can then change your domain's settings, including where your website and email point. ICANN's own page on phishing attacks covers the same risk.

The invoice for search engine submission or a directory listing

The FTC's May 2026 small-business alert, Pay your bills, not scammers, warns that an unexpected invoice may bill for domain registration or search engine optimization services, and tells whoever pays the bills to check each invoice against the vendors the business actually uses. The FTC's guide to scams and your small business adds that directory listing scams can start with a call about a free listing or a renewal, followed by a bill for something you never agreed to.

A search engine submission fee deserves a specific answer. Google says in how Search works that it finds most pages automatically and does not accept payment to crawl a site more often or rank it higher. Some SEO and listing services are real, of course, and Google's page on hiring an SEO notes that no one can guarantee a ranking. So, before you pay, the invoice has to name a service you approved from a vendor you recognize.

A paper offer that never actually demands payment may be a sales solicitation rather than outright fraud. It still deserves the same treatment: confirm the service, the vendor, the amount and the domain's expiry in your real account before anyone pays it.

Real Registrars Send Expiry Notices on a Schedule

Verifying matters because the opposite mistake is just as costly. Under ICANN's Expired Registration Recovery Policy, registrars of generic domains must send expiry notices about one month and about one week before a domain expires, plus a notice after expiry in certain cases. A genuine email from your registrar is part of the system working. Throwing out every notice unread can let a real domain lapse.

Two facts help you sort genuine from fake quickly. First, ICANN says in its renewal and expiration FAQs that it does not collect registration fees from domain holders, so a renewal offer carrying ICANN's name is a reason for suspicion. Second, a notice arriving does not mean the domain has expired. Only your registrar account can tell you that. If the account shows the domain really did lapse, that is a different problem with its own steps, and the first call is to your registrar.

If You Already Paid or Clicked, Act Today

A payment or a typed password is recoverable ground if you move promptly. Start by saving everything: the notice, the envelope, the payment confirmation, the email with its headers, the web address you visited, and screenshots of any pages. Then work through the steps that match what happened. The order matters, because money disputes and account access both get harder with time.

You paid by card or debit card

Contact your card issuer or bank. The FTC's guide on what to do if you were scammed says to tell them the card was used in a scam and ask for the charge to be reversed. Ask what documents their dispute process needs, and replace the card if they advise it.

You typed your registrar password into the page

Go to your registrar's real website by typing the address and reset the password there. Turn on multi-factor authentication if the registrar offers it. Then check the account for users you did not add, email forwarding you did not set up, and any change to DNS records or nameservers, since those decide where your website and email go. Contact the registrar's support or abuse team through its real site. If you see signs the website itself was changed, treat that as a separate security problem and contact your host.

Report it either way

Report fake invoices and phishing at ReportFraud.ftc.gov. The FTC also says phishing emails can be forwarded to the Anti-Phishing Working Group. A report will not get your money back by itself, but it puts the notice on record.

One Owner and a Short Vendor List Stop the Next Notice Cold

The habits that prevent this are small, and they work in a one-person business as well as a larger office. The goal is that whoever opens the mail can answer "do we pay this?" by looking something up, not by guessing. The FTC advises businesses to set clear steps for approving invoices, and to pay only vendors the business actually works with.

• One accountable owner per domain: Name one person who handles every domain and registrar account, plus a backup who knows where the records are. In a one-person business, that is you, and your backup might be a partner or bookkeeper.
• Auto-renew with the real registrar: Turn it on inside your registrar account, but only after confirming the account email and the card on file are current. An expired card defeats auto-renew quietly.
• A backup contact email off the domain: ICANN's guidance on expired registrations points out why this matters. If your only contact address sits on the domain that is expiring, the notices can stop arriving at the moment you need them.
• A short vendor register: Keep one page listing each vendor's legal name, the service, the account web address, who owns the account, the renewal month, the payment method, the usual price range and who approves the bill.
• Registrar lock and MFA: Both make an unwanted transfer or account takeover harder. Neither one tells you whether an invoice is real, so keep the register too.

Once the register exists, a surprising letter becomes a quick lookup. If the company is not on the list and the renewal month does not match, the answer is no, and nobody has to feel pressured by a due date printed in red.

Frequently Asked Questions About fake domain renewal notice

Is every domain renewal letter a scam?

No. Real registrars must send expiry notices for generic domains, so verify each one by signing in to your registrar account directly rather than trusting or ignoring the letter.

How do I verify a domain renewal is real?

Look up the domain at ICANN Lookup, note the registrar and expiry date, then sign in to that registrar from a typed address and compare the notice's company, amount and deadline with your account.

What is domain slamming?

A notice that looks like a renewal but actually moves your domain to a different registrar when you sign or pay it. The FTC documented this practice in its 2003 enforcement actions.

Does a domain name expiration notice scam mean my domain is about to lapse?

Not necessarily. A notice arriving does not mean the domain has expired or is close to it. Only your registrar account shows the real expiry date and renewal status.

Do I have to pay a search engine submission invoice?

No. Google says it finds most pages automatically and does not accept payment to crawl a site more often or rank it higher. A fake directory invoice deserves the same check against your vendor list.

What if I already paid a fake invoice?

Call your card issuer or bank, say the payment went to a scam and ask for a refund. Save the evidence, secure your registrar account if you entered a password, and report it at ReportFraud.ftc.gov.

Wrapping Up

A fake domain renewal notice works by making you decide from the paper. The ten-minute check takes that decision away from the paper: look up your registrar at ICANN Lookup, sign in to the real account yourself, and compare every detail before anything is paid. Real notices still arrive on ICANN's schedule, so the goal is checking, never ignoring. If money or a password already went out, the card issuer, the registrar and the FTC are your three calls.

If you can run the check and everything lines up, you do not need anyone's help for this letter. Renew inside your own account, file the notice, and add the vendor to your list. With one owner, a current card on auto-renew and a one-page vendor register, the next official-looking envelope becomes a two-minute lookup instead of a worry.

Help makes sense when the facts will not line up on their own: you cannot get into the registrar account, you think a password went into the wrong page, or you see DNS or email settings nobody on your side changed. That is where Web Leveling can step in. Our website security audit looks at your live site the way an attacker would, ranks what we find worst-first, and tells you exactly what to ask your host or another account provider for when a fix sits with them. We work with small and medium businesses across the country and overseas. Tell us what the notice says and what you found in your account, and we will help you sort out the next step.

Terms