Anatomy of the scam

The domain-renewal scam mails or emails small businesses a notice that looks like an official invoice. The notice references the business's real domain name (publicly available via WHOIS) and demands payment to renew. The "renewer" isn't the actual registrar.

Variants include "search engine optimization listing renewals," "national business directory renewals," and "iDNS internet listings." All exploit small-business owners' general unfamiliarity with how domains and listings actually work.

Some businesses pay these for years without realizing they're paying for nothing. Others fall for them once, realize, and absorb the loss.

Red flags

  • A bill for a service you don't recall signing up for.
  • The sender is not your known registrar (GoDaddy, Namecheap, Google Domains, Cloudflare).
  • The invoice has "important notice" or "do not ignore" stamped on it.
  • The price is dramatically higher than normal domain renewals ($200+ for what should be $15-$50).
  • Multiple invoices arrive close together for similar "services."
  • Pay-by date is short to create urgency.
  • The bill arrives by physical mail with no email correspondence preceding it.

How to verify safely

  1. Log into your actual registrar to see when your domain truly expires.
  2. Check the sender's name carefully. If it's not your real registrar, it's a marketing pitch or scam.
  3. Search the company name + "scam" or "complaints." Many of these companies are listed at FTC.
  4. Set up auto-renewal with your real registrar so you can ignore every "renewal" pitch from anyone else.
  5. Never pay phone-call domain renewal demands. Real registrars don't cold-call about renewals.

If you already paid

  • Dispute the charge with your credit-card issuer.
  • Cancel any auto-renewal the company may have set up.
  • Verify your real domain status at your real registrar.
  • Report to the FTC and your state AG.
  • Warn other small-business owners in your network.

What not to do

  • Do not pay invoices from companies you don't recognize.
  • Do not assume "they have my domain name" means they're my registrar.
  • Do not sign autopay agreements with cold-calling vendors.
  • Do not ignore — cancel autopay if you accidentally enrolled.

Where to report

  • FTC: reportfraud.ftc.gov — the broadest US fraud intake; reports flow to thousands of law-enforcement agencies.
  • FBI IC3: ic3.gov — the right destination when the scam is internet-enabled (phishing, BEC, romance, crypto).
  • CFPB: consumerfinance.gov/complaint — for complaints about banks, money transmitters, payment apps, credit cards, debt collection.
  • IdentityTheft.gov — if any identity information (SSN, driver's license, account credentials) was shared.
  • Your bank or payment platform. Call the number on the back of your card or use the app's in-product help. Time matters — wires can sometimes be recalled within hours; ACH and Zelle are harder but worth trying.