How did this company get my domain information to send me an invoice?

Domain registration details, including the registrant's name, business, and sometimes contact information, are published in the public WHOIS database unless privacy protection is enabled. Scam operations scrape this data specifically to target domain owners.

Is this the same thing as domain slamming?

Yes — domain slamming is the general term for this practice, where a company designed to look like your registrar sends an official-looking renewal or transfer notice, hoping you will pay them directly instead of your actual registrar.

What happens if I already paid one of these invoices?

Contact your card issuer or payment provider immediately to dispute the charge, and separately confirm with your real registrar that your domain's actual renewal status and registrar-of-record have not changed as a result.

Does enabling WHOIS privacy stop these invoices completely?

It significantly reduces them, since it removes your contact details from the public database these scams rely on, though it does not guarantee zero contact if your information was scraped before privacy was enabled.

Official-looking domain renewal invoice letter next to a laptop showing a real registrar login page

Domain Security

That Domain Renewal Invoice Might Be a Scam — Here's How to Tell

Domain 360 Team

·July 18, 2026·3 min read

An official-looking letter or email arrives: a domain name expiration notice, complete with your actual domain name, a due date, and a payment link — for seventy-five dollars, sometimes more. It looks real enough that plenty of business owners pay it without a second thought, only to later discover the money went to a company that has nothing to do with where their domain is actually registered.

Quick answer: Legitimate renewal notices come only from your actual registrar, addressed to the account on file, and never demand payment via wire transfer or gift card. A third-party invoice from a company you never registered with is a scam — check your registrar dashboard directly instead of clicking anything in the notice.

How This Scam Works

Domain registration details are published in the public WHOIS database by default unless privacy protection is turned on. Scam operations scrape this data at scale, cross-reference upcoming expiration dates, and mail or email something designed to closely resemble an official renewal notice — often using language like domain name expiration notice or listing service that sounds procedural rather than promotional.

The trick works because the domain name and expiration date in the notice are real and accurate, which lends the whole thing false credibility. The company sending it, though, is not your registrar — it is a completely separate business hoping you won't notice the difference before paying.

How to Tell If a Renewal Notice Is Real

Check that the sender's company name matches your actual registrar exactly — not a similar-sounding name, and not a generic domain services or registration bureau label. Log into your registrar account directly by typing the URL yourself, rather than clicking any link in the notice, and check your actual renewal status and price there. Be suspicious of any notice using urgency language, threatening imminent loss of the domain within days, or offering pricing noticeably above what you know you've paid before. And never pay via wire transfer, cryptocurrency, or gift cards for a domain renewal — legitimate registrars accept standard card payments through their own checkout.

What to Do If You Already Paid

Contact your card issuer immediately to dispute the charge — most of these scams process payments in a way that's still reversible shortly after the transaction. Then log into your actual registrar account and confirm the domain's renewal status and registrar-of-record haven't been altered, since a small number of these scams are actually disguised, unauthorized transfer requests rather than simple invoice scams. If anything about your account looks different, contact your real registrar's support directly and flag it.

The most durable fix is prevention: enable WHOIS privacy protection if it isn't already on, which removes your details from the public database these operations rely on. And build the habit of treating every renewal notice, even ones that look completely legitimate, as a prompt to check your account directly rather than click through, the same way you'd treat any unexpected invoice. If you're unsure what you're actually supposed to be paying for renewal, our breakdown of fair domain renewal pricing is a useful reality check against inflated third-party quotes.

Never lose a domain again

Track every domain you own in one dashboard. Free for up to 15 domains.