A domain renewal scam usually arrives as a letter headed something like “Domain Name Expiration Notice”, with your web address on it, a deadline, and a table of prices for one, two or five years. It looks like a bill. It is an offer to move your domain to a company you have never dealt with, and the small print says so. It is one of a handful of cons aimed squarely at small businesses, and they all work the same way.
What does a fake domain renewal notice look like?
The letters have been around for more than twenty years and have barely changed. They tend to share these features:
- Your domain name, correctly spelt, because it is public information.
- A heading with “expiration”, “renewal” or “final notice” in it.
- A date, often close to your real renewal date, which is also public.
- A price table for several years at once, often well above a normal renewal.
- A sender whose name sounds like a registry or an official body.
- Small print saying that paying authorises a transfer to them.
That last line is the whole trick. Paying does not renew anything with your current registrar. It starts a transfer, and if it goes through, your domain sits with a company you did not choose, at its prices. If the transfer changes where the domain points, your website and email can stop working until someone untangles it.
Nominet, which runs the .uk registry, has warned about versions of this for years, and its advice has stayed the same: check with your own registrar before paying anything.
How to check who really looks after your domain
Every domain has a registrar, the company you or your web designer bought it from. You can find it in two minutes without trusting anything in the letter.
- Look the domain up. For a .uk or .co.uk address, use Nominet’s lookup at nominet.uk/lookup. For a .com, use ICANN’s at lookup.icann.org. Both show the registrar and the expiry date.
- Compare the name. If the company on the letter is not the registrar in the lookup, the letter is not a renewal.
- Log in to the registrar yourself. Type its address into the browser rather than following a link. The renewal date, the price and the auto-renew setting are all there.
- Turn on auto-renew if the domain matters to you, and make sure the card on the account has not expired.
If the lookup shows a registrar you do not recognise, the domain may have been registered by a former web designer in their own name. That is a different problem, and .co.uk or .com, and who should own your domain covers how to check who owns it and how to get it moved to you.
“Someone is registering your brand in China”
This one arrives by email. A “registration centre” says another company has applied to register your business name as a .cn, .asia or similar domain, and asks whether you authorised it. If not, they can “protect” your name by registering the whole set for you, today.
There is no other company. The message is a sales pitch for domains you do not need, and the deadline is there to stop you asking anyone first. Do not reply, even to say no: a reply confirms that the address is read. If your business genuinely trades in China and has a trade mark there, that is a question for a trade mark attorney, not for whoever emailed you.
Calls “from Google”
The call says your Google listing is about to be removed, or is not verified, or could be put at the top of the map for a fee. Google’s own help page on fraudulent calls is plain about what its staff will and will not do. Google does sometimes call businesses, often with an automated message, to check details. But the page says “You won’t be asked to sign up for a service, pay money, or give personal info”, that its operators “will never ask you for payment information over the phone”, and that they will not promise special placement.
Setting up and keeping a Google Business Profile is free. Nobody can sell you a guaranteed place in the map results: Google’s page on local ranking says “There’s no way to request or pay for a better local ranking on Google.” The honest version of this service exists: someone charging for their time to manage your profile. The dishonest version starts with a threat. If you want to check, hang up and open your profile at business.google.com yourself. Google also has a form for reporting calls that pretend to be from it. How to get your business on Google Maps covers what the profile needs.
Trade mark and Companies House invoices
On 21 May 2026, Companies House and the Intellectual Property Office issued a joint warning about unsolicited invoices from organisations with no link to government. They usually arrive by post at a registered office, sometimes by email, and ask for money to renew a trade mark, to join an “exclusive online register”, or to set up or verify a Companies House account.
Two facts help with these. A UK trade mark is renewed through GOV.UK, and as of October 2026 the official fee is £245 for the first class plus £60 for each extra class. A “renewal” invoice for several times that, from a company you have not heard of, is not the IPO. And identity verification for Companies House, which directors are being asked to complete, is free when done through GOV.UK One Login. Authorised agents can charge for doing it for you, but nobody needs to pay an invoice that arrives unasked.
The IPO asks for suspicious invoices to be sent to misleadinginvoices@ipo.gov.uk.
One rule that catches all of them
The details change every year. The shape does not: something arrives that you did not ask for, it says you owe money or will lose something, and it offers a way to pay inside the message. So the rule is about the route, not the content.
- Right you look up the company you already buy from, go to its site or call its number from your own records, and check there.
- Wrong you call the number on the letter, click the link in the email, or let the caller “transfer you to accounts”.
Never pay, or give a login code, through a channel the message gave you. A genuine supplier will still be there when you contact it your own way. Every one of the cons in this article depends on you using the route it chose.
It also helps to keep one short note somewhere safe: who your domain is registered with, who hosts the website, who handles email, and the date each one renews. A letter that does not match the note is answered before you have finished reading it.
Where to report a scam in the UK
-
Emails
Emails go to report@phishing.gov.uk, run by the National Cyber Security Centre. Forward the whole message.
-
Texts
Texts go to 7726, which is free and passes the message to your mobile provider.
-
Losses
Losses go to Report Fraud, the City of London Police service that replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or 0300 123 2040, in England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.
-
Invoices
Invoices for trade marks go to the IPO’s address above, and any misleading invoice can also go to your local Trading Standards, found through GOV.UK.
If you have already paid by card or bank transfer, call your bank first, using the number on the back of your card. The sooner they know, the more they can do.
If a letter about your website has you wondering what state the site itself is in, send it to us. We reply in writing with the three things we would change first, and there is nothing to pay.
For the domain itself, there is .co.uk or .com, and who should own your domain, and if the person who registered it is no longer answering, web designer disappeared? How to get your website back.
Official sources
The official pages behind the points above:
