An unexpected domain renewal notice deserves prompt checking, but the message itself is not proof that the sender manages your domain. Open your registrar account using a bookmark or address you already trust and compare the exact domain and renewal date there. If you cannot identify the registrar, use the appropriate registry lookup and contact the provider through its independently verified details.
Do not pay, enter account credentials or approve a transfer through a link in a message until you have verified the request. An unsolicited offer from another registrar can look like a renewal; accepting it may start a different transaction from renewing with the existing provider.
Compare the notice with the account
Check the full domain spelling and extension, the registered provider, the renewal date and the service being requested. A similar domain with one extra character or a different extension is not the same registration. Check whether the document is an invoice for an existing service or an offer to register, transfer or buy a different name.
Compare it with your business’s authorised account record, not only an old email. Providers and resellers can change their branding or billing arrangements, so a different name alone does not prove fraud. If a reseller handles the domain, ask the known reseller or registrar using a number or address obtained independently from the suspicious notice.
Watch for pressure to change the account
A message may claim that the domain will be lost immediately or that a transfer must be approved without time to check. A real expiry can be urgent, so check the account promptly; urgency is a reason to verify, not a reason to follow an unverified payment link. Do not send passwords, one-time codes or transfer authorisation codes to an unverified contact.
ICANN warns that fraudulent messages can misuse its name and branding. ICANN says it does not itself process registrations or collect renewal fees directly from registrants. A message claiming to be an ICANN renewal bill should therefore be checked with the actual registrar. Nominet and registrars may send legitimate messages for .uk names; verify any individual notice using a trusted account or provider contact rather than treating a logo as authentication.
If you already clicked or supplied information
Stop interacting with the page and contact the real provider through a known route. Explain what you entered or approved and when, without sending passwords or one-time codes in the support message. If payment details were supplied, contact the payment provider using its established contact details. Follow the business’s incident process and the provider’s instructions for securing the account; preserve the message for investigation.
If the domain has actually expired, ask the registrar about recovery promptly. Our guide to recovering an expired business domain explains the immediate checks. Do not assume that a particular grace period applies to every extension. The domain renewal and DNS checklist helps the business record the correct account, renewal date and recovery route for next time. If you are planning a website handover in Formby, Freshfield or L37, contact Formby Web Design to discuss the website work.
Source: ICANN guidance on phishing and domain-related messages. This guide offers a verification process; it cannot identify a particular message as genuine or fraudulent without investigation.
