Fake domain renewal invoices: how to spot the scam.

What the scam looks like

You get a letter, email or text that looks like an invoice. It says your domain name is about to expire, or that you must “renew” or “register” it, usually with a company you have never dealt with. The amount is often much higher than a normal renewal, and there is a deadline to make you act quickly.

Some are letters sent to the address on the public domain record. Some are emails to the contact address. Either way, the goal is to get you to pay for something you do not need, or to hand over a login.

Five quick checks

1. Do you know the company? A real renewal comes from the registrar or host you actually use, not a stranger.
2. Is there pressure? Urgent deadlines and threats of losing your site are a warning sign.
3. How are they asking you to pay? Be wary of bank transfers to a name you do not know, gift cards, or a payment link in the message.
4. Does it match your records? Check the exact domain name and the registrar named. Scammers often get small things wrong.
5. Does the real record agree? Look the domain up yourself. See below.

Check your real expiry date

Run a whois lookup on your domain. It shows the registrar that looks after it and the expiry date. If the registrar is not the company in the message, the message did not come from the company that holds your domain. The domain checker shows the same details alongside your DNS, email and security.

If you want to renew, open your registrar in your own browser by typing the address, and log in there. Do not use links in the message.

If you have already paid

1. Call your bank straight away and tell them it was a scam. They may be able to stop or recall the payment.
2. Report it to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
3. Change any password you shared, and turn on two-step login for your registrar.
4. Tell us if the domain is with Binfield, so we can check it is safe.

Report scam emails and texts

Forward suspicious emails to report@phishing.gov.uk. Forward scam texts to 7726, which is free. Then delete the message.

How to stay ahead of it

• Turn on auto-renew, and keep a card on file with your registrar.
• Keep the contact email on your domain current, and make sure you can read it.
• Keep the registrar lock on, so the domain cannot be moved without you.
• Keep a note of who your registrar is. If a bill is from anyone else, it is not your renewal.