Domain renewal scams and how to spot them

What is a domain renewal scam?

A domain renewal scam is a fake notice that tells you your domain name is about to expire and asks you to pay to renew it. The notice comes from a company that is not your registrar. It is designed to look official, with urgent language, a deadline, and a payment form or link. If you pay, you do not simply renew your domain. You authorize a transfer to a different registrar, often at two to five times the normal price.

The companies behind these scams pull your contact information from public WHOIS records. Every registered domain has an owner name, email, and sometimes a mailing address on file. Scammers use that data to send notices that look like they are connected to your current registration. They count on the fact that most people do not remember exactly which company manages their domain and will pay a renewal notice without checking.

This is different from domain hijacking, where someone takes control of your domain by breaking into your account. With a domain renewal scam, you hand over control yourself by responding to a fake notice.

How do domain renewal scams work?

The process follows a pattern. A company sends you a notice that looks like a bill. It includes your domain name, an expiration date, and a price to "renew." The language is designed to create urgency. Words like "final notice," "expiration warning," and "act now to avoid losing your domain" are common.

If you pay the amount listed, the fine print on the notice authorizes a domain transfer. Your domain moves from your current registrar to the scam company's service. You now have a new registrar you did not choose, a higher renewal price going forward, and the hassle of transferring your domain back if you want to leave.

The scam works because it mimics something real. Domains do expire. You do need to renew them. And legitimate registrars do send reminders. The difference is that these notices come from a company you never signed up with, and paying them means giving up control of where your domain is managed.

What do these scam notices look like?

Domain renewal scams reach you through several channels. Each format uses the same tactic but looks different enough that it helps to recognize all of them.

Physical letters

Some scam companies send printed letters through the mail. These look like invoices, complete with your domain name, a due date, and a total amount. The layout often mimics a government form or an official billing statement. The company name is designed to sound authoritative, sometimes including words like "domain registry" or "domain services." Because it arrives on paper, many brand owners treat it like a real bill and pay it without a second thought.

Email notices

A domain scam email is the most common form. It arrives with a subject line like "Domain Expiration Notice" or "Urgent: Your domain is about to expire." The body includes your domain name, a date, a price, and a link to pay. The sender name often sounds like it could be a registrar. The link leads to a payment page that looks professional but belongs to a company you have never heard of.

Phone calls

Less common but still used, some scam operations call domain owners directly. The caller claims to be from a "domain registry" and says your domain is about to expire or that someone else is trying to register it. They push you to renew over the phone with a credit card. The pressure is immediate, and the caller relies on the fact that you cannot easily verify the claim while on the line.

What are the red flags of a fake domain renewal notice?

Every domain renewal scam shares a set of common traits. Here is what to look for before you respond to any renewal notice.

• The company name does not match your registrar. This is the first and most reliable check. If you registered your domain through one company and the notice comes from a different one, that is a red flag. Log into your registrar account to confirm who manages your domain.
• The price is higher than normal. Scam notices often charge $30 to $80 or more for a single year of registration. Standard .com renewals cost far less. If the price feels inflated, it probably is.
• The language creates panic. Phrases like "final notice," "immediate action required," and "your domain will be deleted" are designed to make you pay without thinking. Legitimate registrars send calm, clear reminders well in advance of expiration.
• The payment link goes to an unfamiliar site. Hover over any link in the notice before clicking. If the URL does not match your registrar's website, do not click it.
• There is fine print about transferring your domain. Look carefully at the terms on the notice. Many scam notices include a line buried in small text that says paying the invoice authorizes a domain transfer. A real renewal does not require you to transfer anything.

What happens if you fall for a domain renewal scam?

If you pay a fake renewal notice, your domain gets transferred to the scam company's registrar service. You are now their customer, whether you wanted to be or not. The immediate effects are predictable.

Your renewal price goes up. The company that now manages your domain charges a premium rate, often two to five times what you were paying before. You did not agree to this rate knowingly, but the fine print on the notice you paid covers them legally.

Your domain settings may change. The new registrar may have different DNS management tools, different support response times, and different policies. If your email, website, or SSL settings depend on your old registrar's tools, things can break during the transfer.

Getting your domain back to your original registrar means going through a full domain transfer process. That takes time, may involve a waiting period, and costs another transfer fee. In the meantime, your domain is in the hands of a company you did not choose.

How do you verify a real renewal notice?

The safest approach is to never act on a renewal notice directly. Instead, use these steps to verify whether the notice is real.

Log into your registrar account. Open your browser, go to your registrar's website directly (not through a link in the email or letter), and check your domain's expiration date. If your domain is not close to expiring, the notice is fake. If it is close to expiring, renew it through your registrar's dashboard. You can find your expiration date by following the steps in how to check your domain expiry date.

Compare the sender to your registrar. Check the company name on the notice against the company you see when you log into your account. If they do not match, the notice did not come from your registrar.

Never click links in renewal emails. Even if the email looks legitimate, type your registrar's URL into your browser manually. This eliminates the risk of landing on a phishing page designed to steal your login credentials.

Check the price. If the renewal price in the notice is significantly higher than what you normally pay, that is a strong signal that the notice is not from your registrar.

What should you do if you already paid a scam notice?

If you realized too late that the notice was not from your registrar, act quickly.

Contact your credit card company or bank. Explain that you paid an invoice under false pretenses. Depending on how recently the payment was made, you may be able to dispute the charge or request a chargeback.

Contact your original registrar. Let them know what happened. If the domain transfer has not completed yet, they may be able to stop it. If the transfer already went through, they can walk you through the process of transferring the domain back.

Lock your domain immediately. If you still have access to your registrar account, enable the registrar lock (also called a transfer lock) to prevent any further unauthorized transfers. The chapter on domain security covers how locking works and why it matters.

File a complaint. In the United States, you can report the scam to the Federal Trade Commission (FTC). In other countries, contact your national consumer protection agency. Reporting helps authorities track repeat offenders.

How do you protect yourself from domain renewal scams?

Prevention is straightforward once you know how these scams operate.

Know your registrar. Write down or bookmark the name of the company where your domain is registered. When a renewal notice arrives, you can check it against your records in seconds.

Turn on auto-renewal. Most registrars offer automatic renewal. When auto-renewal is active, your domain renews itself before expiration. You do not need to respond to any renewal notices at all, which removes the opportunity for a scam to work. The chapter on how to renew a domain walks through setting this up.

Enable domain privacy. WHOIS privacy replaces your personal contact information in the public WHOIS database with your registrar's proxy details. When scammers cannot see your name, email, or mailing address, they cannot target you with fake notices.

Lock your domain. A registrar lock prevents your domain from being transferred without your explicit approval. Even if you accidentally authorize a transfer by paying a scam notice, the lock adds a step that can catch the mistake before the transfer completes.

Ignore notices from companies you do not recognize. If the sender is not your registrar, you owe them nothing. Throw the letter away or delete the email.

How does WEMASY send renewal reminders?

When your domain is connected to WEMASY, renewal reminders come from inside your WEMASY dashboard. You receive notifications through the platform itself, not through a random third-party email. The sender is always WEMASY, and you can verify any renewal details by logging into your account directly.

WEMASY also supports auto-renewal for connected domains, so your domain stays active without manual intervention. If your domain is approaching its expiration date, WEMASY notifies you in advance so you have time to review your settings. You can see what is included with your plan at WEMASY pricing.

Frequently asked questions

The next chapter covers DNSSEC, the security protocol that protects your domain's DNS records from being tampered with during lookups.