Fake Domain-Renewal Invoices: the Classic Scam to Watch For

A fake domain-renewal invoice is a letter or email dressed up as a bill from your registrar. In reality it is a solicitation to switch you to another company, or an outright scam. The classic case is the US Federal Trade Commission's 2003 action against Domain Registry of America, which the FTC said mailed millions of renewal-looking notices. The rule that protects you: never pay a renewal from an unsolicited notice.

How the scam works

The scam is a notice, mailed or emailed, designed to look like a bill from your own registrar. The landmark example is the FTC's 2003 case against Domain Registry of America (DROA).

According to the FTC, DROA's mailings appeared to be "renewal notices or invoices from the consumers' current registrars". Each warned that a domain was about to expire, then asked for payment to renew it.

The trap was in the fine print. Paying the notice did not renew anything with your existing registrar. It transferred your domain to DROA's registrar instead.

The FTC said DROA mailed millions of these, each captioned "IMPORTANT NOTICE". The notices pressed people to act fast, warning of "Register Lock" or the "loss of your online identity" if they delayed. The case settled, which is not an admission of wrongdoing, but the pattern it described is the template every later version still copies.

How to tell a fake from a real renewal

A real renewal comes from the company you already pay. Almost everything else is a red flag.

Start with who your registrar actually is. A WHOIS lookup on your domain shows the registrar of record, and that is the only company that renews it.

This table sorts a fake notice from a genuine renewal.

Signal	Fake notice	Genuine renewal
Sender	A company you do not pay	Your registrar of record
Channel	Often posted mail	Email from your account
Tone	Act now, or lose the name	A reminder, with a login link
Payment	Pay a new company	Renew inside your existing account
Price	Often far above your usual fee	Your normal renewal price

A genuine registrar usually reminds you by email, from the account you set up, and sends you to log in. A paper invoice from an unfamiliar business is the warning sign.

A real invoice can shock you too

Not every surprising renewal bill is a scam. A genuine invoice can jump sharply when a first-year promotional price ends, and that is a real charge from your real registrar, not fraud.

That is a different problem, covered in why renewal costs more than year one.

The test still holds either way. If the bill comes from the registrar you already pay, it is real, however unwelcome. If it comes from a stranger, it is the scam.

What to do when a notice arrives

Do not pay an unexpected renewal notice. Log in to your registrar account directly and check the real expiry date there.

If the domain is genuinely close to renewal, renew it inside your own account, never through the notice. Confirm you are not near losing the name while you are logged in.

If you already paid a fake notice and it triggered a transfer, contact your original registrar at once and dispute the charge with your bank. The faster you act, the more likely the transfer can be stopped or reversed.

In our experience, lapsed and expired-domain trouble does happen, and these notices are built to exploit exactly that anxiety. The renewal reminder that matters is the one inside your own registrar account, not the one that lands in your letterbox.

Frequently asked questions

Are all domain-renewal letters scams?

No. A real registrar does send renewal reminders, usually by email from the account you signed up with. The scam is the unsolicited notice from a company you do not pay, built to look like a bill. The test is the sender: if it comes from your registrar of record, it is real, and if it comes from a stranger, treat it as a scam. Log in to your account to confirm either way.

What happens if I pay a fake renewal notice?

Often you do not renew anything. Instead you transfer your domain to the sender's registrar, sometimes with an undisclosed fee attached, which is what the FTC alleged in its Domain Registry of America case. Contact your original registrar and your bank the moment you realize. A fast dispute can sometimes reverse the transfer before it completes, so speed matters more than anything else.

How do I find out who my real registrar is?

Run a WHOIS lookup on your domain, which names the registrar of record. That is the only company that can renew the name, so any bill from anyone else is suspect. Cross-check it against who you actually pay each year. If the two do not match, or you cannot log in to the registrar the lookup shows, that gap is worth sorting out before any renewal is due.

Do these scams target .my domains?

The tactic works on any extension, .my included. For a .my domain, your registrar is a MYNIC-appointed company, so a renewal notice from any other business is a warning sign. Renew only through the registrar you originally signed up with, and ignore paper invoices from names you do not know.

Is a fake renewal invoice the same as phishing?

They overlap. A phishing version of this scam tries to steal your login or card details through a fake link, rather than just misdirect a payment. Treat both the same way: never act from the notice itself. Open a new browser tab, go to your registrar directly, and check your account there. The notice is never the safe route in.

A domain you control, on a calendar you trust

Storming Solutions builds custom-coded websites and maintains existing WordPress sites for businesses across Kuala Lumpur and the rest of Malaysia. We keep every client's domain in their own name, renewed on a schedule we watch. A domain you control, with reminders you trust, is one a scam notice cannot rattle.

Got a renewal notice you are not sure about? Forward it before you pay, ask us to check it, or read who should own your domain so the renewal always lands with you. Our web development clients rarely wonder whether an invoice is real, because they know exactly who holds the name.