Fake Domain Renewal Notices: The Invoice Scam Targeting Every Business That Owns a Website

The email lands in your inbox like any other invoice. Your domain is expiring soon. Renew now or your website, your email, your business goes offline. There's a button. There's an amount due. It all looks exactly right.

So you click.

That's the moment a fake domain renewal scam gets you. And it's working on business owners every day, because it's built around a real, legitimate concern that every website owner actually has.

What is a fake domain renewal scam?

A fake domain renewal scam is a phishing attack disguised as a routine billing notice from your domain registrar. The email (or physical letter) looks like it's from GoDaddy, Namecheap, Squarespace (formerly Google Domains), or whatever registrar you use. It names your actual domain. It gives a price. It says your deadline is soon.

The catch: the sender has nothing to do with your domain. They're not your registrar. Paying them doesn't renew anything. It just moves your money, and sometimes your account credentials, straight to a scammer.

These campaigns aren't new. TechRepublic flagged fake domain renewal notices as far back as 2007, describing how scammers used public domain records to make phony renewal letters look legitimate. The tactics have only gotten more convincing since. Today's versions arrive as polished emails, complete with professional branding, fake reference numbers, and countdown timers. They pull real WHOIS data to display your actual domain name and registrar back at you, which makes them feel like they're already connected to your account. They aren't.

How the scam works, step by step

Understanding the mechanics makes it much harder to fall for.

Step 1: They find your domain in public records. Every registered domain appears in WHOIS or RDAP records, and that database is public. Today it mostly shows your domain name, registrar, and registration and expiry dates, while contact details are typically redacted. Scammers harvest this in bulk, fill in the gaps from other sources such as your own website, then generate personalized-looking emails at scale.

Step 2: They send an invoice that looks routine. The message uses language like "final notice," "renewal required," or "service continuity." Some versions look like plain invoices. Others come with professional branding, reference numbers, and even fake office addresses. What they all share, as the FTC's May 2026 alert on fake invoices describes, is that they bill you for something you never ordered, often with "past due" pressure to pay before anyone checks, here dressed up as a routine renewal from your existing registrar.

Step 3: They manufacture urgency. Countdown timers. Red banners. Urgent expiry warnings. Disappearing discount prices. Exit-blocking pop-ups warning that your domain is at risk. None of these reflect your actual renewal date. The pressure is manufactured, and that's exactly the point. Real registrars do send expiry reminders, but those go to your account email and point you to a login on their own site, not a payment link on an unfamiliar domain.

Step 4: They collect your money or your credentials. Some fake renewal flows redirect you to a payment page and simply take your credit card details. Others ask for your registrar login or a domain transfer authorization code. The second outcome is worse. A stolen authorization code can move your domain to a registrar the scammer controls, and getting it back can be a long, complicated process.

Why so many people fall for it

Fake invoices are a costly, persistent problem for businesses. Business email compromise (BEC) is a related but distinct crime, in which a legitimate business email account is compromised or spoofed to redirect payments, rather than a fake renewal notice. Even so, it shows how much money moves through fraudulent payment requests: the FBI's Internet Crime Complaint Center recorded $3.05 billion in BEC losses across 24,768 complaints in 2025, according to its 2025 IC3 Annual Report.

Domain renewal notices are particularly effective because they exploit something real. You do have a domain. It will expire eventually. A notice arriving months before actual expiry hits a window where you might not remember the exact date. A busy bookkeeper or office manager who sees what looks like a routine vendor invoice might just approve it, especially if the company name in the email sounds vaguely familiar.

The scam also feels personal. Scammers know your domain name and registrar, and often your business name or address from your own website. Much of that is public, but seeing your own details reflected back at you on a renewal page makes it feel like the site is really connected to your account.

It isn't.

Red flags to look for

You don't need to be a security expert to catch these. You just need to slow down for 60 seconds before clicking anything.

• The sender's email doesn't match your registrar. A company claiming to be a major registrar but sending billing notices from a Gmail address is an immediate tell. Guardio's phishing red flag checklist flags the sender domain as a key warning sign. A mismatch is a strong signal, but a matching sender doesn't prove a message is real, because addresses can be spoofed and lookalike domains exist, so confirm in your registrar account either way.
• The urgency feels forced. Countdown timers, "final notice" language, and shrinking discount prices are pressure tactics. Real registrars send reminders too, but they don't pair them with a payment link on an unfamiliar domain.
• The company name is vague or unfamiliar. Names like "Domain Services Inc." or "Domain Name Services" are built to sound official without actually being your registrar.
• The "renew" button doesn't go to your registrar's domain. Hover over it before clicking. If the URL doesn't match your actual registrar, don't click.
• They're asking for your authorization code or login. A renewal should never require your transfer authorization code. That code is for moving your domain to a different registrar.
• The email arrives from a sender you didn't set up notifications with. Your real registrar is the only company that should be contacting you about your domain's renewal.

What to do if you get one of these emails

Don't click anything in the email. Not the link, not the "unsubscribe" button, nothing.

Open a new browser tab and go directly to your registrar's website by typing the address yourself or using a saved bookmark. Log in to your account and check your domain's actual expiry date there. If the date doesn't match what the email claims, you have your answer.

If you're not sure which company is your registrar, use ICANN's own lookup at lookup.icann.org, typing the address yourself rather than clicking a link in the suspicious email. Your registrar's name will appear in the results.

If you already clicked the link but didn't enter any information, you're most likely fine. Close the page, update your security software, and run a scan in case anything was downloaded. If you entered payment details or login credentials, act fast: contact your bank or card issuer, change your registrar password immediately, and check whether any domain transfer requests are pending in your account.

How to protect your domain going forward

A few simple habits keep you well ahead of these scams.

Know your registrar. Write it down. Seriously. Many business owners aren't sure which company manages their domain because it was set up years ago by a developer or agency. Find out now, log in and confirm, and save the URL.

Enable auto-renew and pay attention to the billing emails. When you set up automatic renewal through your actual registrar, you remove the window of uncertainty these scams exploit. You'll also know exactly what a real renewal notification from your registrar looks like.

Lock your domain. Most registrars offer a "domain lock" feature that prevents transfers unless you explicitly unlock it. It takes two minutes to enable and blocks transfers unless someone with access to your account removes the lock, which is why a strong password and multi-factor authentication matter too.

Turn on multi-factor authentication for your registrar account. If a scammer gets your password, MFA keeps them from logging in to unlock your domain or request a transfer code. Use an authenticator app or passkey rather than SMS where your registrar supports it.

Use a security tool that flags suspicious links before you click. Guardio's browsing protection blocks known scam and phishing sites before they open, on your computer and your phone, and its email security flags phishing emails that slip past Gmail's spam filter into your inbox. If a fake renewal page is already known to be malicious, you'll see a warning before you ever enter your information. Get a free security scan with Guardio today and stay protected from phishing.

Conclusion

Fake domain renewal scams work because they're built around a real worry. Your domain matters. Losing it would be a genuine problem. Scammers know that, and they use it.

The good news is that the scam has clear tells. Mismatched sender addresses, manufactured urgency, vague company names, and buttons that don't lead to your actual registrar are all signals worth pausing on. A 60-second check inside your registrar account is all it usually takes to confirm whether a renewal notice is real.

Know your registrar. Lock your domain. And when a renewal email lands in your inbox, verify before you pay.

Get a free security scan with Guardio today and stay protected from phishing.