Domain scams that target small businesses, and how to spot every one.

Why domain owners get targeted

Domain registration records used to publish owners’ names, addresses and emails for anyone to read. Privacy redaction has reduced that a lot, but expiry dates, registrars and older scraped data are still easy to find. That makes domain owners an easy list to target, and small businesses are attractive because the person reading the mail is often also the person who pays the bills.

None of these scams is sophisticated. They work because they arrive at a busy moment and look official, often with a deadline of a few days and a logo that resembles one you know. Learn the patterns once and they become easy to ignore, and you can teach whoever opens the mail or pays the invoices to spot them too.

1. The renewal notice that is really a transfer

A letter or email arrives that looks like an invoice: your domain name, an expiry date, a “renew now” amount. Read the small print and it is not from your registrar at all. Paying it authorizes a different company to transfer your domain to them, usually at a much higher yearly price.

How to stay safe: know who your registrar is (it is shown on ICANN Lookup), turn on auto-renew there, and only ever renew by logging in to that registrar directly, never through a link or a mailed form.

2. “Someone is trying to register your brand in Asia”

An email claims to come from a registrar or “domain audit” office overseas. A company, it says, has applied to register your business name under several country extensions, and as the brand owner you have a short window to register them first. The prices are high and the urgency is invented. There is no applicant.

How to stay safe: ignore it. If you genuinely sell into another country, research that country’s extension yourself, through a registrar you choose.

3. The buyer who needs you to get an appraisal

Someone writes offering a surprisingly good price for a domain you own. They are keen, but first their company needs a “certified appraisal” from a specific website, which costs a modest fee. You pay; the buyer disappears. The appraisal site and the buyer are the same people.

How to stay safe: real buyers do not care which appraisal you have, and there is no such thing as a certified domain appraisal that a buyer must insist on. If you want to understand what a name is worth, read what a domain name is actually worth or use our free value checklist, which deliberately never invents a number.

4. The look-alike escrow site

Escrow is the right way to buy or sell a domain: a neutral party holds the money until the domain has transferred (how it works). Scammers know that, so some deals arrive with an insistence on an “escrow service” you have never heard of. The site looks professional, shows the money as received, and urges you to transfer the domain. No money was ever there.

How to stay safe: choose a well-established escrow company yourself, type its address into your browser rather than clicking a link, log in to confirm funds are really held, and check that the company is licensed where it says it operates. Be wary of anyone who refuses every escrow service except theirs.

5. Phishing for your registrar login or auth code

The real prize for many scammers is control of your domain itself. With your registrar login, or with the domain’s authorization (EPP) code and an unlocked domain, they can move it away from you. Under ICANN’s Transfer Policy, that code is what proves the right to transfer, so treat it like the keys to your shop. Phishing emails imitate your registrar (“your domain has been suspended, log in to verify”) to capture your password.

How to stay safe: turn on two-factor login at your registrar, keep the registrar lock on, use a unique password, keep your account email address at a different domain from the one you are protecting, and only ever share an auth code to complete a sale you agreed, after payment is secured in escrow.

6. The seller who does not own the domain

On the buying side, the risk flips. A name you want appears for sale at an attractive price, but the “seller” does not control it. They may be hoping you pay before you notice, or they may have stolen it.

How to stay safe: ask the seller to prove control, for example by putting a specific short message on the domain’s landing page or adding a DNS record you choose. Pay only through escrow, check the domain’s history (how), and be suspicious of any recent change of registrar or creation date that does not fit the story you are being told. Our domain buyer’s checklist walks through every check.

7. “Search engine registration” invoices

A notice warns that your domain’s “search engine listing” is about to expire and asks for an annual fee. Google and Bing do not charge to be included in search results. Your site is crawled for free; Search Console and Bing Webmaster Tools are free too.

What a legitimate domain deal looks like

It helps to know what normal looks like, so the abnormal stands out. A genuine purchase usually goes like this:

1. Buyer and seller agree the price and what is included in writing, often by email.
2. One side opens a transaction at an established escrow company that both have checked independently. The buyer pays the escrow company, not the seller.
3. The escrow company confirms the funds are held. Both sides can see this by logging in to their own escrow account.
4. The seller unlocks the domain and provides the authorization code, or pushes the domain to the buyer’s account at the same registrar.
5. The buyer confirms the domain is in their account. Only then does escrow release the money to the seller.

Nothing in that sequence requires an appraisal, an urgent deadline, a gift card, a crypto payment or a link you did not type yourself. Any of those is a reason to stop and check.

The habits that beat all of them

• Know your registrar and renew only by logging in there directly.
• Auto-renew on, registrar lock on, two-factor login on.
• Never pay an invoice for a domain service you did not order.
• Never pay a buyer’s chosen appraiser, and never use an escrow service you did not choose and verify.
• Slow down whenever a message is urgent. Real deals survive a day of checking.

If something has already happened

Contact your registrar immediately; they can often freeze changes or help recover a domain that was moved without your authority. In the U.S., report fraud to the FTC at ReportFraud.ftc.gov and internet crime to the FBI’s IC3. Keep every email and receipt.

Buying from us? Every name in our portfolio is one we hold directly, we use escrow on request, and a real person answers the phone. If you are unsure about any offer or invoice, send it to us through the contact page and we will tell you honestly what we think. And if the name you want belongs to someone else, our find it for me service handles the research and the approach safely, start to finish.

Sources, none of them ours: ICANN Transfer Policy · ICANN Lookup · FTC: ReportFraud · FBI Internet Crime Complaint Center (IC3)