Fake Domain Renewal Notices and How to Spot Them

If you own a domain, your inbox will fill with notices that look official: expiring soon, final warning, verify your listing. Some are real reminders from your registrar. Many are not. This guide shows what ICANN and the FTC say, and a three-step check that takes two minutes.

What does ICANN say?

ICANN, the organization that coordinates the domain name system, has posted warnings for years. A 2014 ICANN blog, “Be Careful What You Click,” describes the scam: a scammer emails a registrant offering a chance to renew a registration, urging a click to renew at attractively low rates, and the email may look like it comes from ICANN, with its logo and branding lifted. ICANN states that it does not process domain registrations or collect fees from registrants directly, and that all fee collections are transactions between the registrar and the registrant.

ICANN's April 2020 registrant guidance goes further: “ICANN will never send registrants a WHOIS Data Reminder Policy (WDRP) notice, registration data verification request, domain name expiration reminder, or domain name renewal request message.” If you get an email about your domain that purports to come from ICANN, it says to contact your sponsoring registrar directly to ask whether it is real. Phishing emails, it adds, often forge a trusted sender's address or use a lookalike domain.

What are the warning signs?

The FTC's guidance on phishing says scam messages often “tell a story”: an account problem, a billing issue, an invoice you do not recognize, or a request to click a link to make a payment. It adds that legitimate companies will not email or text with a link to update your payment information. Domain scams add their own marks:

• The sender is not your registrar, or the name is close but not the same.
• It pushes a deadline, such as 24 hours, and says your site or email will go dark.
• It offers to renew for many years at a price far from your registrar's, or asks you to transfer your domain.
• The link goes to a payment page on a domain you do not recognize.

A two-minute check

Do these three things, in order:

• Do not click the link or call the number in the message. The FTC's advice is to contact the company using a phone number or website you know is real, not the information in the message.
• Open a new browser window, go to your registrar's website by typing its address, and log in. Look at the expiration date and the auto-renew setting there.
• If the dates are fine, delete the message. If you paid or typed a password, change it at once, including anywhere you used it, check your card statement and see what to do after a phishing click.

Make the real renewal easy

The strongest defense is that nothing is pending. Turn on auto-renew at your registrar, keep a payment card on file that is not close to expiring, and use an email address for the registrar account that is not tied to the domain, as ICANN advises, so a lapsed domain cannot lock you out of its own mail. ICANN also recommends enabling multi-factor authentication at the registrar and asking for a registrar lock, which can help block unauthorized transfers. See two-step verification.

Put the renewal date on a calendar with a note of which registrar holds the name. Our domain name guide and choosing a domain name cover the basics.

If you want help

If you are not sure who holds your domain, ask the person who built your website, or check with High Desert if the company registered it for you; it lists domain registration as a service, and you can call 775-575-9593 any day from 9 to 5. Also report fake notices: forward ICANN lookalikes to compliance@icann.org, and report to ReportFraud.ftc.gov.

If the provider question is still open, the check form takes your address. From there a person looks at the tower path and calls you back with what they found.