Domain name scams target three kinds of people: owners who have to renew, sellers who want an offer, and buyers who want a name. The tricks differ, but each one asks you to pay or log in somewhere you would not have chosen yourself.
Below, each is sorted by who it targets, with the published warning and the check that defeats it. Sources were read on 18 October 2026; older warnings are dated.
Domain name renewal scams aimed at owners
The oldest trick is a bill. In May 2026 the FTC warned small businesses about fake invoices: “It bills your company for things you didn’t order — maybe tech support, domain registration, or search engine optimization services.” It adds that “some invoices arrive with a ‘past due’ notice” to create urgency.
A related version is the domain name services scam letter that claims to come from your registrar. An ICANN report from 2012 defined “slamming” as notices “claiming to be or to represent the current registrar”, sent to get you to “switch registrars unnecessarily” or to “Reveal credentials or provide authorization codes to facilitate theft of the domain”.
The defence is simple. Your registration renews with your registrar, inside your account, reached by typing its address. Before you believe any “expiring” notice, check the real date yourself: the free Domain Expiry Checker shows when a domain expires and, if it has lapsed, which stage it is in.
Fake ICANN emails and registrar phishing
ICANN has warned about emails using its name for years, and its standing rule settles most of them. From its 2020 guidance: “ICANN will never send registrants a WHOIS Data Reminder Policy (WDRP) notice, registration data verification request, domain name expiration reminder, or domain name renewal request message.” An email from “ICANN” asking you to renew or pay is fake by definition.
The registrar version is harder to spot, because your registrar really does email you. Namecheap describes domain phishing as links that “forward unsuspecting domain owners to dodgy replica registrar websites” to collect usernames and passwords. Its knowledgebase lists the tells: a generic greeting such as “Dear Namecheap Member”, a claim “that your account has been suspended”, and links with “extra letters or signs”.
Read the real domain in any link. GoDaddy’s help page gives the example http://login.google.com.evilphishingsite.com/index.html, where “the site you’re really on is evilphishingsite.com.” ICANN’s rule covers the rest: “Never enter your password into a page you arrived at by following a link in email.”
The appraisal scam aimed at sellers
A 2016 post on Namecheap’s blog, by Andrew Allemann, describes it: “You get an email out of the blue from someone who wants to buy your domain name.” The scammer “then makes a very high offer”, and then “the buyer demands that you pay for an appraisal of the domain name’s value. Not only that, but they require you to get it from a specific appraisal service that they trust.”
The tell is in that last line. The post explains: “When they ask you to get the appraisal from someone they know, that’s when you know you’re being scammed, because the person who sent you the email actually owns the so-called appraisal service!” Once you send the certificate, “you’ll never hear from the ‘buyer’ again.”
Sedo warned in 2020 about emails asking owners to use “a partner allegedly authorized by Sedo”, and stated that “Sedo does not require domain assessments for selling or purchasing domains.” The Namecheap post’s rule is the one to keep: “If someone asks you for an appraisal before buying your domain name, demand that they order the appraisal and pay for it. If they don’t agree, it’s probably a scam.”
You do not need a paid certificate to know roughly what a name is worth. The free Domain Worth Calculator maps a name’s extension, length, words, characters, age and links to a value band, and our guide to domain appraisal explains how to build a range. For real offers, see how to sell a domain name.
Fake escrow and “pay me directly” scams aimed at buyers
Buyers face the mirror image: a seller who steers the payment. Escrow.com’s fraud guidance says scammers “often have a seemingly good reason why they can’t use Escrow.com and will recommend an alternative.” Warning signs include a site that looks “similar to Escrow.com in design”, “person-to-person payment methods like Western Union” and “Suspiciously low escrow fees.”
Its FAQ is blunt: “Be wary the moment a seller begins to stipulate the escrow site that must be used”, and “Whenever you are asked to pay money to an individual rather than a corporate identity … consider it a fraudulent scheme.” Type the escrow service’s address yourself; our guide to domain escrow covers how the process should run.
A marketplace that controls the payment removes the seller from that decision. On the SERPHeroes Domain Marketplace, buyers and sellers never talk directly, and the rule is stated plainly: “Never pay a seller directly. Payment runs through Escrow.com as standard, or directly to SERPHeroes if you request alternative payment. Either way, the seller is paid only after the domain is in your account.” It is one safe option among several.
Domain name scams examples at a glance
| Scam | What it looks like | Red flag | What to do |
|---|---|---|---|
| Fake invoice or renewal bill | An invoice for “domain registration” you didn’t order (FTC, 2026) | Unfamiliar sender, “past due” notice | Search the company name with “review,” “scam,” or “complaint” (FTC) |
| Fake “ICANN” renewal email | A “click here” renewal “at attractively low rates” with ICANN’s logo (ICANN, 2014) | ICANN “never requests payment of fees from registrants” | “Contact your sponsoring registrar directly” (ICANN) |
| Slamming | A notice “claiming to be or to represent the current registrar” (ICANN, 2012) | Not from your registrar | Renew only inside your registrar account |
| Registrar phishing | Links to “dodgy replica registrar websites” (Namecheap) | Generic greeting, “account has been suspended” | Change your password, turn on two-factor authentication |
| Appraisal scam | A high offer, then an appraisal “from a specific appraisal service that they trust” | The buyer insists on their appraiser | “Demand that they order the appraisal and pay for it” |
| Fake escrow | The seller recommends “an alternative” to Escrow.com | New escrow domain, Western Union, low fees | Refuse an escrow site the seller chooses |
A limitation: none of these sources publishes figures on how common domain scams are or what they cost victims, and we have no data of our own on it. There is also no single domain name scam checker; the checks above are the test.
Lock your domain and report the attempt
ICANN’s protective advice is short: “Enable multi-factor authentication if your registrar supports it”, “Ask your registrar to apply a ‘registrar lock’ on your domain names”, and “Use a different email address for your registrar account than your domain name registration information.” You can confirm the lock is on with a lookup; our guide to domain status codes shows what it looks like.
To report, the FTC says to “Forward phishing emails to the Anti-Phishing Working Group at [email protected]” and to report “fake invoices, and other scams to the FTC at ReportFraud.ftc.gov.” For an email pretending to be from ICANN, forward it to [email protected]. The FTC’s full alert is Run a small business? Pay your bills, not scammers.
Before you pay anyone for a domain, follow the safest way to buy a domain from someone: check who controls it, pay through escrow and get the transfer done before the money is released.
Frequently asked questions
Does ICANN send domain renewal notices?
No. ICANN says it “will never send registrants” a domain name expiration reminder or renewal request, and it does not collect fees from registrants. Contact your registrar about any such email.
Is an email offering to buy my domain a scam?
Not necessarily. It becomes one when the “buyer” asks you to pay for an appraisal from a service they name. A genuine buyer can order and pay for their own appraisal.
How do I know a domain registration invoice is real?
Check it against your own registrar account, reached by typing its address. If the sender isn’t your registrar, the FTC suggests searching its name with “review,” “scam,” or “complaint.”
Can I pay a domain seller by wire transfer?
Escrow.com advises treating any request to pay an individual rather than a company as a fraudulent scheme. Use an escrow service you reach yourself.
The takeaway Renew only inside your registrar account, refuse to buy appraisals for buyers, and never let a seller choose where your money goes. Then lock the domain and turn on two-factor authentication.
