Owning a domain puts your business details in front of scammers. Soon after registering, many owners start receiving official-looking "renewal notices", urgent warnings that another company wants to register their name, or emails that appear to come from their registrar asking them to log in. Some are aggressive sales tactics; others are outright fraud designed to take your money or your domain. They all rely on the same thing: most people don't deal with domains often enough to know what a genuine notice looks like. This guide explains the common scams, how to check whether a notice is real, and the settings that protect your domain.
The common domain scams
1. Fake renewal invoices ("domain slamming")
A letter or email that looks like a renewal invoice for your domain, often with an amount due and a deadline. Read the small print and it's usually an offer to transfer your domain to a different company, or a charge for something you never ordered, such as a "search engine submission" or "web listing". Paying it can mean paying for nothing, or moving your domain to a provider you didn't choose.
2. "Someone wants to register your brand" emails
An email from a so-called registration agency claiming that another company has applied to register your name with other extensions or in another country, and offering you the chance to register them first, at a high price. The "other company" usually doesn't exist; it's a pressure tactic to sell you domains you don't need.
3. Registrar phishing
An email that copies the style of your registrar or host: "your domain will be suspended", "payment failed", "verify your account". The link goes to a fake login page that steals your password. With access to your account, a fraudster can change your DNS to redirect your website or email, or try to transfer the domain away.
4. Expired-domain and "SEO" offers
Messages offering to "restore your expired domain", buy your domain, or boost its ranking for a fee. Some are genuine sales approaches; many are not. None of them need an urgent payment from you.
How to check whether a notice is genuine
Before you pay anything or click any link, check these four things:
- Who is your actual registrar or host? Look in your records, or at past invoices you know are genuine. A notice from any other company is not a renewal from your provider, whatever it says.
- When does the domain actually expire? Log in to your provider's dashboard by typing its address yourself, not through a link in the message, and check the expiry date and any outstanding invoices there.
- Does the message create urgency? "Final notice", "within 24 hours", "your domain will be released". Genuine providers do send reminders, but you can always verify them in your account.
- Do the payment details make sense? Bank details that differ from your provider's usual ones, or a request to pay an individual, are red flags. Call your provider on a number you already have.
If you're not sure, forward the message to your provider's support and ask. A legitimate provider would rather answer a question than have you pay a scammer.
Settings that protect your domain
Registrar lock
A registrar lock stops the domain being transferred to another provider until you unlock it. Leave it on all the time, and unlock it only when you deliberately move the domain. Generic domains like .com also use an EPP code (an authorisation code) for transfers; treat it like a password and never send it to someone who asks for it unsolicited. Our guide to transferring a .co.za domain explains how genuine transfers work.
Auto-renew and up-to-date contacts
Many domains are lost not to fraud but to genuine renewals going unnoticed. Turn on auto-renew, keep a payment method or prepaid balance available, and make sure the contact email on the account is one someone actually reads, not a former employee's inbox. If a domain does lapse, what happens when a domain expires explains the recovery stages.
Two-factor sign-in
Turn on two-factor authentication for your hosting and registrar account. Even if a phishing email captures your password, the attacker still needs the code from your phone. See two-factor authentication with an authenticator app.
Keep the domain in the business's name
Register domains in the business's name, with an account the business controls. Domains registered by a former web developer or employee in their own name are a common cause of disputes.
If you've already paid or clicked
Act quickly:
- Paid a fake invoice? Contact your bank immediately to ask about stopping or reversing the payment, and keep the paperwork.
- Entered your password on a suspicious page? Change the password straight away from the real site, turn on two-factor sign-in, and check your DNS records and contact details for changes.
- Domain transferred or DNS changed without your consent? Contact your registrar's support at once with proof of ownership. The sooner they know, the more options there are.
Scams that impersonate suppliers by email are closely related; our guide to invoice fraud and email compromise covers the email side.
Frequently asked questions
Do domain registries send renewal invoices directly to owners?
Generally, no: you renew and pay through the registrar or reseller you registered with. A renewal bill from a company you've never dealt with should be treated with suspicion.
Should I buy my name in every other extension when offered?
Only if you would actually use it or need it to protect a well-known brand. An unsolicited offer with a deadline is not a reason to buy.
Is it a scam if someone offers to buy my domain?
Not always, but be careful: some "buyers" are a lead-in to charging you for a valuation or listing service. Never pay a fee to receive an offer.
How do I know which company my domain is registered with?
Check your past invoices and the dashboard you use to manage DNS. A WHOIS lookup for your domain also usually shows the registrar.
On NewHost, domain registration includes a registrar lock, EPP codes you reveal only when you need them, renewal invoices 30 days before expiry and auto-renew from your wallet, all in the same dashboard as your email hosting and website.