The three checks that tell a real renewal from a fake one, and what to do if you have already paid.
Resources / I got a "domain renewal" invoice. Is it a scam?
Often, yes. Fake domain renewal notices are one of the oldest scams aimed at small businesses: a letter or email that looks like an invoice, warns your domain is about to expire, and is really selling you a different name, or phishing for your details. Before paying, check three things: the domain name matches yours exactly, the sender is the company you already registered with, and your domain really is due. If any of the three is off, do not pay.
Look-alike renewal notices one reseller sent before the ACCC took it to court
Small business complaints to the ACCC about paying one, in a single year
Grace period to renew a genuine .au domain after it expires
There are two common versions. The first is a letter or email made to look like an invoice. Scamwatch describes them as having "the appearance of an invoice or renewal notice", with credit card logos, a payment slip and sometimes a barcode. The catch is in the small print: it is not renewing your domain at all. It is selling you a new, similar one, such as the .com version of your .com.au, which is a different name and not interchangeable.1
The ACCC said that in 2016 alone it received over 100 complaints from small businesses that paid one of these letters without realising what they had bought.1 Some thought they had renewed their real domain, which meant the genuine renewal could be missed.
This is not new. In 2002 the ACCC took a reseller to the Federal Court over about 70,000 unsolicited "renewal" notices that resembled invoices and were sent to people who had never dealt with it.2 The letters keep coming because enough people pay them.
The second version is phishing. An email claims to be from auDA, the body that runs .au domain names, or from your registrar, and asks you to click a link to confirm your contact details "in order to retain" your domain.4 The link leads to a fake page that collects your login, your card details or copies of your ID.
auDA's advice is not to click the links, reply, or send any identification to the sender, and to report it.4 Worth knowing: auDA does not sell or renew domain names itself. You renew through the registrar or reseller you bought it from.5 So a bill "from auDA" is a warning sign on its own.
This version is more dangerous than the letter. Paying for a look-alike domain wastes money. Handing over the login to your real domain can give someone control of your website and email.
Is it exactly your domain? Read the name letter by letter. Look for a different ending, .com instead of .com.au or .net.au instead of .com.au, or a small spelling change.3
Is it from the company you registered with? Your genuine renewal comes from your own provider.5 If you do not recognise the sender, do not use any link, phone number or payment details in the notice. Log in to your provider's site the way you normally would, or ring them on a number you already had.
Is your domain actually due? Check the real expiry date. Our free Domain Checker shows who holds any domain and when it expires, in seconds. A .au domain can only be renewed in the 90 days before it expires,5 so a "final notice" for a domain with two years left is not real.
If all three line up, it is very likely genuine, and paying through your provider's own website is still the safest way to do it.
If you paid by card, call your bank straight away and ask about a chargeback. The sooner you ask, the better the chance.
If you clicked a link and entered a password, change it now, starting with your domain provider's account and your email, and turn on two-step sign-in. Then check that your domain's contact details and settings have not been changed. If you sent identification documents, IDCARE can help with next steps. auDA suggests reporting to the police, to the Australian Signals Directorate at cyber.gov.au/report, and to Scamwatch.4
Finally, check your genuine domain is still in date. If the real renewal was missed because the fake one looked like it, a .au domain has a 30 day grace period after expiry. After that it is removed and anyone can register it.5
Keep a short record of your domains: the exact names, who you registered them with, and when each expires. Five minutes of admin makes every fake notice obvious.
Renew for longer, and turn on auto-renew with your real provider. .au domains can be licensed for up to five years at a time.5 The fewer renewal moments there are, the fewer chances a fake has to look plausible.
Give whoever opens the mail and pays the bills a simple rule. The ACCC suggests clear procedures for verifying and paying invoices, and flagging anything unusual for review.1 A domain renewal from a company you have never paid before gets checked with the owner first, every time.
If a web designer or IT provider registered the domain for you, find out which provider it is with and whose email address receives the renewal notices. If the genuine reminders go to someone outside the business, the only renewal notices you ever see may be the fake ones, and that is exactly when a convincing letter gets paid.
Free Domain Checker: See who holds your domain and when it really expires.
The invoice arrived with new bank details. Is it a scam?: The other invoice scam: how payment redirection works and how to check.
You clicked a phishing link. What should you do in the first hour?: If you already clicked: the steps, in order.
Check three things: the domain name matches yours exactly, including the ending; the notice comes from the provider you registered with; and your domain is genuinely due. If any one is off, do not pay, and check through your provider's own website instead.
No. auDA runs the .au domain system but does not sell or renew domain names. You renew through the registrar or reseller you bought the domain from, so an invoice from auDA is a warning sign.
No. They are different domain names. Letters that offer the .com version of your .com.au are selling you a new name, not renewing yours, and Scamwatch says the two are not interchangeable.
Call your bank straight away and ask about a chargeback if you paid by card. If you also entered a password, change it and turn on two-step sign-in, and report the scam to Scamwatch.
You have a 30 day grace period to renew it through your provider. After that it is removed from the registry and anyone can register it, so check your real expiry date if you are unsure.
Send us the domain and who the notice is from. We will tell you whether it is genuine, who really holds your domain and when it expires. Free, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems