--- title: Fake Domain Renewal Notices and How to Spot Them url: https://hdiss.net/guides/fake-domain-renewal-notices/ business: High Desert Internet Services (HDISS) phone: 775-575-9593, 775-391-5660 email: info@hdiss.net mailing_address: Home base: 200 S Virginia St, Suite 760, Reno NV 89501 (dispatch office, not a walk-in store). Mail: Billing Dept., PO Box 11353, Reno NV 89510 hours: Office open 9:00 AM to 5:00 PM, seven days a week. Network watched around the clock. type: Fixed wireless internet service provider (homes and small businesses), web hosting, customer email, domain registration service_area: Northern Nevada - Washoe, Lyon, Storey, Churchill and Douglas counties and Carson City; availability is checked address by address (line of sight to a tower) plans: Bronze $50/mo up to 500 Mbps down, up to 200 Mbps up; Silver $75/mo up to 800 down, up to 200 up; Gold $99/mo up to 1 Gig down, up to 200 up; ask about the up to 1 Gig / 1 Gig ultra-low-latency service no_online_purchase: true (check your address or call; existing customers pay at https://www2.fernley.net/hdiss/onlinepay/paymentform.cfm) since: 2002 --- - [Home](https://hdiss.net/) - [Guides](https://hdiss.net/guides/) - Fake domain renewal notices and how to spot them # Fake Domain Renewal Notices and How to Spot Them A message that says your domain is about to expire and asks you to click and pay may be a scam, especially if it claims to come from ICANN. ICANN says it never sends renewal or expiration reminders to registrants; check your real renewal date by logging in to your registrar yourself. A lenticular cloud over the Sierra. Stock photo: Adobe Stock. [Photo credits](https://hdiss.net/photo-credits/) On this page - [What does ICANN say?](#what-does-icann-say) - [What are the warning signs?](#what-are-the-warning-signs) - [A two-minute check](#a-two-minute-check) - [Make the real renewal easy](#make-the-real-renewal-easy) - [If you want help](#if-you-want-help) If you own a domain, your inbox will fill with notices that look official: expiring soon, final warning, verify your listing. Some are real reminders from your registrar. Many are not. This guide shows what ICANN and the FTC say, and a three-step check that takes two minutes. ## Takeaways - ICANN says it will never send registrants a WHOIS Data Reminder Policy notice, a registration data verification request, a domain name expiration reminder or a renewal request. - ICANN does not process registrations or collect fees from registrants; those are transactions between registrar and registrant. - The FTC says legitimate companies will not email or text a link to update your payment information. - Report ICANN lookalikes to compliance@icann.org. ## What does ICANN say? ICANN, the organization that coordinates the domain name system, has posted warnings for years. A 2014 ICANN blog, “Be Careful What You Click,” describes the scam: a scammer emails a registrant offering a chance to renew a registration, urging a click to renew at attractively low rates, and the email may look like it comes from ICANN, with its logo and branding lifted. ICANN states that it does not process domain registrations or collect fees from registrants directly, and that all fee collections are transactions between the registrar and the registrant. ICANN's April 2020 registrant guidance goes further: “ICANN will never send registrants a WHOIS Data Reminder Policy (WDRP) notice, registration data verification request, domain name expiration reminder, or domain name renewal request message.” If you get an email about your domain that purports to come from ICANN, it says to contact your sponsoring registrar directly to ask whether it is real. Phishing emails, it adds, often forge a trusted sender's address or use a lookalike domain. ## What are the warning signs? The FTC's guidance on phishing says scam messages often “tell a story”: an account problem, a billing issue, an invoice you do not recognize, or a request to click a link to make a payment. It adds that legitimate companies will not email or text with a link to update your payment information. Domain scams add their own marks: - The sender is not your registrar, or the name is close but not the same. - It pushes a deadline, such as 24 hours, and says your site or email will go dark. - It offers to renew for many years at a price far from your registrar's, or asks you to transfer your domain. - The link goes to a payment page on a domain you do not recognize. ## A two-minute check Do these three things, in order: - Do not click the link or call the number in the message. The FTC's advice is to contact the company using a phone number or website you know is real, not the information in the message. - Open a new browser window, go to your registrar's website by typing its address, and log in. Look at the expiration date and the auto-renew setting there. - If the dates are fine, delete the message. If you paid or typed a password, change it at once, including anywhere you used it, check your card statement and see [what to do after a phishing click](https://hdiss.net/guides/clicked-a-phishing-link-what-now/). ## Make the real renewal easy The strongest defense is that nothing is pending. Turn on auto-renew at your registrar, keep a payment card on file that is not close to expiring, and use an email address for the registrar account that is not tied to the domain, as ICANN advises, so a lapsed domain cannot lock you out of its own mail. ICANN also recommends enabling multi-factor authentication at the registrar and asking for a registrar lock, which can help block unauthorized transfers. See [two-step verification](https://hdiss.net/guides/two-step-verification/). Put the renewal date on a calendar with a note of which registrar holds the name. Our [domain name guide](https://hdiss.net/guides/what-is-a-domain-name/) and [choosing a domain name](https://hdiss.net/guides/choosing-a-domain-name/) cover the basics. ## If you want help If you are not sure who holds your domain, ask the person who built your website, or check with High Desert if the company registered it for you; it lists domain registration as a service, and you can call 775-575-9593 any day from 9 to 5. Also report fake notices: forward ICANN lookalikes to compliance@icann.org, and report to ReportFraud.ftc.gov. If the provider question is still open, the check form takes your address. From there a person looks at the tower path and calls you back with what they found. ### Sources - [icann.org/en/blogs/details/be-careful-what-you-click-alert-of-new-fraudulent-domain-renewa](https://www.icann.org/en/blogs/details/be-careful-what-you-click-alert-of-new-fraudulent-domain-renewal-emails-29-9-2014-en) (ICANN, Be Careful What You Click, September 29, 2014, read 10/15/26) - [icann.org/en/blogs/details/do-you-have-a-domain-name-heres-what-you-need-to-know-30-4-2020](https://www.icann.org/en/blogs/details/do-you-have-a-domain-name-heres-what-you-need-to-know-30-4-2020-en) (ICANN, Do You Have a Domain Name, April 30, 2020, read 10/15/26) - [consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams) (FTC, How To Recognize and Avoid Phishing Scams, read 10/15/26) ### Talk to a person - Call [775-575-9593](tel:7755759593) [775-391-5660](tel:7753915660) Open 9-5 every day - Email [info@hdiss.net](mailto:info@hdiss.net) [Check my address](https://hdiss.net/check-availability/#check) Local since 2002 Fixed wireless from towers in Northern Nevada. Three plans, no contracts, local support, 4.8 on Google from 36 reviews. [About High Desert](https://hdiss.net/about/) ### Keep reading - [What a domain name is and who owns it](https://hdiss.net/guides/what-is-a-domain-name/) - [Choosing a domain name for a local business](https://hdiss.net/guides/choosing-a-domain-name/) - [You clicked a phishing link: what to do next](https://hdiss.net/guides/clicked-a-phishing-link-what-now/) - [Spotting phishing email that pretends to be your internet provider](https://hdiss.net/guides/spotting-phishing-from-your-provider/) - [Two-step verification: the one setting worth turning on](https://hdiss.net/guides/two-step-verification/) ## More on email and hosting how-to - [POP3 vs IMAP in plain words](https://hdiss.net/guides/pop3-vs-imap/): POP3 downloads your mail to one device and normally removes it from the server; IMAP leaves the mail on the server so every device sees the same inbox. High Desert Internet's customer email uses a POP3 server, pop.h - [Keeping email when you change devices](https://hdiss.net/guides/keeping-email-when-you-change-devices/): Before you retire the old phone or computer, turn on the setting that leaves a copy of mail on the server, copy or export what is stored on the old device and check what shows in webmail. High Desert's mail uses POP - [What a domain name is and who owns it](https://hdiss.net/guides/what-is-a-domain-name/): A domain name is the address people type to reach your website and the ending of your email addresses, registered through a company called a registrar. The person or business named as the registrant holds it, and keeps i ## Questions people ask ### What if the notice has my real domain and my real expiry date? Scammers can look up public registration data. A correct detail does not make the sender real. Check at your registrar. ### Is the WHOIS verification email real? Some registrars do send verification emails, so check at your registrar. ICANN says it does not send them itself.