Domain Renewal Scam Letters and Fake Domain Invoices
Domain renewal scam letters and emails — an official-looking notice says your domain is expiring, needs "search engine registration", or is about to be registered by someone in Asia, and asks you to pay or act fast.
Common signs of this issue
- A domain renewal scam letter or email arrives titled something like "Domain Name Expiration Notice" from a company you have never dealt with.
- The notice quotes a renewal price several times higher than you normally pay, and says renewing will move your domain to their company.
- An email titled "Domain SEO Service Registration" or "search engine submission" looks like an invoice, with your domain name and a due date, but is really an offer for a worthless service.
- An email from a "registration service" in China or Hong Kong says another company wants to register your business name in .cn, .asia, or other extensions and asks whether you authorized it.
- A message warns your domain will be suspended or deleted within 24 or 48 hours unless you log in through a link.
- The sender's details, registrar name, or payment method do not match anything on your existing domain account.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Find out who your real registrar is before doing anything. Go to ICANN's free lookup at
lookup.icann.org, type your domain, and look at the Registrar name and the Registry Expiry Date. This uses RDAP, the modern replacement for WHOIS, and it is the official record. - Compare that registrar name with the company on the letter or email. If they do not match, the letter is not a renewal bill. At best it is a sales pitch to transfer your domain to a more expensive company; at worst it is outright fraud.
- Check the expiry date from the lookup. If your domain is not due for months, a notice saying it is urgent is false. If it genuinely is close to expiring, renew through your existing registrar account, not through the letter.
- Log in to your registrar by typing its address yourself or using a bookmark — never through a link in the email. Check that auto-renew is on and the card on file is current. Genuine expiry warnings will also appear inside your account.
- Read the small print on paper letters. Many contain wording like "this is not a bill" or "by renewing, you agree to transfer" — phrases that confirm it is a solicitation, not an invoice you owe.
- For "SEO service registration" emails, check whether they ever claim to renew your domain. They do not — they offer to "submit" your site to search engines, which Google and Bing do for free. Nothing happens if you ignore them.
- For the Asian registration emails, ask yourself whether you do business in China or need those extensions. The usual pattern is that nobody else is registering your name; the email exists to sell you a bundle of domains at inflated prices. Ignoring it is the normal answer.
- If you suspect a fake invoice has already been paid, contact your bank or card issuer promptly and ask about disputing it, and report the message as phishing in your email program.
What this usually means
Domain names are public. Anyone can see your domain, its expiry date (in many cases), and often your business postal address, and some companies use that to send official-looking notices at scale. The paper version usually belongs to a transfer solicitation: it is legally worded so that paying it moves your domain to the sender's company, typically at a much higher price, with your DNS and email settings possibly lost in the move. The emailed versions range from these same solicitations to outright phishing designed to steal your registrar login.
"Domain SEO service" emails and "Asian domain registration" emails are different tricks aimed at the same target. The first dresses up a useless search-engine submission service as an invoice with your domain name and a due date, hoping your bookkeeper pays it. The second invents a rival company about to register your brand in foreign extensions, to pressure you into buying them. In both cases your existing domain is not at risk, and doing nothing is safe.
Your real registrar is the only company that can renew your domain, and you can confirm who that is in under a minute. The real risk is not the scam itself — it is losing track of your genuine registrar account, so you cannot tell a real warning from a fake one. If the lookup shows a registrar you do not recognise, or an account set up by a former web designer, that is the thing to fix. See domain registered to someone else and domain expired or not resolving.
What not to do
- Don't pay a domain renewal letter just because it has your domain name on it. Check the registrar name first.
- Don't click links in domain expiry or suspension emails. Go to your registrar by typing the address yourself.
- Don't transfer your domain to a company that contacted you out of the blue. Transfers can break your website and email if done carelessly.
- Don't reply to Asian domain registration emails. Replying confirms your address is active and starts a high-pressure sales process.
- Don't pay search engine submission or SEO service registration invoices. Google and Bing find and index sites for free.
- Don't let auto-renew lapse because you are unsure which notices are real. Losing a real domain is far worse than ignoring a fake one.
When to get help
Get help when you cannot work out which company actually holds your domain, when the lookup shows a registrar nobody at the business has a login for, or when you have already paid a letter and your domain may have been moved. Those situations can escalate quickly: a domain in the wrong account or a lapsed renewal can take your website and email offline, and recovering it gets harder with each day past expiry. Someone experienced can confirm the registrar and ownership record, recover or consolidate your account, lock the domain, switch on auto-renew, and make sure the contact email on file is one you actually read — so real warnings reach you and fake ones are obvious.
Glenn at WebsiteSelfHelp helps small businesses confirm who really controls their domain and get it safely under their own account. Describe the letter or email you received, and he will give you a straight answer on whether it is legitimate and what, if anything, you need to do. You will not need to share any passwords to start.
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Frequently asked questions
Is a domain name expiration notice letter a scam?
Often it is a transfer solicitation from a company that is not your registrar. Paying it may move your domain to them at a higher price. Look up your registrar on ICANN's lookup tool and compare names before paying anything.
How do I find out who my real domain registrar is?
Use ICANN's free lookup at lookup.icann.org. Enter your domain and look for the Registrar field and the expiry date. That is the only company that can renew it for you.
What is a Domain SEO Service Registration email?
It is a solicitation disguised as an invoice, offering to submit your site to search engines. It has nothing to do with renewing your domain, and ignoring it has no effect on your website.
Is someone really trying to register my business name in China?
Almost never. These emails are sales tactics to sell you extra domain extensions. Unless you actively do business there and need those domains, ignore the email and do not reply.
What happens if I ignore a fake domain renewal letter?
Nothing. Your domain stays with your real registrar and renews as normal, as long as your own account has auto-renew on or you renew it yourself before expiry.
I already paid a domain renewal scam — what should I do?
Contact your bank or card issuer quickly about disputing the charge, check with your real registrar whether a transfer has been requested, and make sure your domain is locked. If it has already moved, get help recovering it promptly.
How can I tell a real domain expiry email from a fake one?
Real ones come from your actual registrar, match the expiry date in the ICANN lookup, and show the same warning when you log in to your account directly. Fake ones use urgency, unfamiliar company names, and links to login pages.