An email arrives saying your domain name expires soon and your website and email will stop working unless you renew today. It has your domain in the subject line, a professional-looking invoice and a “Renew now” button. Or it says your hosting account has been suspended for a billing problem and asks you to log in to fix it.
Some of these messages are real. Many are not. The fake ones are written to make you act before you think, because a business owner who believes the website is about to go dark will click quickly. Here is how to tell the difference calmly, and what to do with each kind.
The common versions of the scam
The look-alike renewal invoice
Domain registration details are often public, so anyone can find out when a domain was registered and when it is due. Some companies use this to send official-sounding “renewal notices” or invoices. Paying one does not renew your domain with your current registrar. At best it moves your domain to a different company at a higher price. At worst the money simply disappears.
A variant is the “search engine listing” or “domain directory” invoice. It is laid out like a renewal bill, but the small print says you are buying a listing service you never needed. It has nothing to do with whether your website stays online.
The fake suspension or payment failure
This one looks like it comes from your host or registrar: “Your account has been suspended”, “Your payment failed”, “Verify your billing details right away”. The button leads to a copy of a login page. Whatever you type there goes straight to the attacker, who can then log in to the real account, change the DNS, point your domain somewhere else, or read your email.
“Someone wants to register your brand”
You receive a message from an unfamiliar registrar in another country, saying a company has applied to register your business name under several foreign domain endings, and asking whether you want to register them first. It is a sales trick. There is usually no other company, and you do not need those domains.
The fake SSL or security warning
Similar in style: your “SSL certificate is expiring” or “your site has malware, click to scan”. Real certificate warnings exist, but they come from the company that actually issued your certificate, and many hosts renew them automatically.
How to check any renewal email in a few minutes
You do not need to judge the email itself. Check the facts independently.
- Know who your registrar is. This is the company you pay for the domain. It may be the same company as your host, or it may not. If you are not sure of the difference, our post on domains versus hosting explains it. You can look up any domain’s registrar in the public lookup tool run by ICANN, at lookup.icann.org.
- Compare the sender to that registrar. If the email is from a company you have never paid, it is not your renewal, whatever it says.
- Do not use the link. Type your registrar’s or host’s address into the browser yourself, or use a bookmark, and log in there. If there really is a renewal due or a suspension, it will be shown in your account.
- Look at the actual expiry date in your account. Scam notices often arrive months early, or for a domain that is already set to renew automatically.
- Check the sending address, not just the name. The display name can say anything. The address after the @ often gives the game away, although a careful scammer can register a domain that looks very close to the real one.
If after all that you are still not sure, ring or chat with your registrar’s support through the contact details on their real website and ask. It takes a few minutes and costs nothing.
Signs that should make you stop
- Extreme urgency: “today”, “within hours”, “final notice”, on the first message you have ever received about it.
- A price very different from what you normally pay. Our page on domain renewal costs gives you a sense of what is normal.
- Payment by an unusual method, such as a bank transfer to a personal account, gift cards or a payment link from an unknown site.
- A login page whose address in the browser bar is not your provider’s real domain.
- Generic greetings like “Dear domain owner”, where your real provider would use your account name.
- Attachments that are compressed files or ask you to “enable content” to view an invoice.
If you have already clicked or paid
Stay calm and work through this in order.
- If you entered a password on a fake page, change that password straight away on the real site, from a different device if you can. Change it anywhere else you used the same one. Turn on two-factor authentication for the registrar and hosting accounts.
- Check the account for changes. Look at the domain’s nameservers and DNS records, the contact email on the account, and whether a transfer has been requested. If anything has changed that you did not do, contact the registrar’s support immediately.
- If you paid, contact your bank or card provider and explain that it was a scam payment. The sooner you call, the better the chance of stopping it.
- Turn on the registrar lock (often called transfer lock) if it is not already on. It stops the domain being moved to another registrar without your approval.
Make the next one easier to ignore
- Switch on auto-renew with your real registrar, with a card that will not expire before the renewal date. Then any “renew now or lose it” email is easy to dismiss.
- Use an email address you actually read as the contact on your domain and hosting accounts. Real reminders often go unseen because they are sent to a former employee or a developer.
- Keep a short note of your registrar, host, renewal dates and who has access. When a suspicious email arrives, anyone in the business can check it against the note.
- Protect your own domain from being spoofed. The same trick works in reverse: someone can send email pretending to be you. Setting up SPF, DKIM and DMARC makes that harder.
And remember what a real lapse looks like, so a fake one does not scare you. When a domain or hosting plan genuinely expires, there is usually a grace period, and the site stops working in a recognisable way. If that has actually happened, our guide to a site that is down because hosting expired walks you through getting it back.
When you want someone to check for you
If you are looking at an email now and are not sure whether it is real, or you have lost track of where your domain and hosting actually live, we can look at it with you. Our hosting and domain support starts at ₹799 onwards for a single session, and the first answer is often simply “ignore it”.
Next in this series: HTTP Security Headers Explained in Plain Language
