Spot the domain scam

1. Read each message as though it had arrived in your inbox or your post on a busy day.
2. Decide whether it is genuine or a scam. There is no penalty for being wrong.
3. Read the tell — the single decisive detail — and what to do when you receive one like it.
4. Finish the round and read your two error counts separately: scams you would have paid, and genuine mail you would have binned.
5. Play again. The items reorder, and the ones you are least sure about are the ones worth seeing twice.

Pay attention to the second error type. Binning a genuine renewal notice feels like the safe mistake — it is how domains get lost.

You interact with your domain registrar perhaps twice a year, and the interaction is forgettable enough that most business owners genuinely cannot name the company they bought their domain from. That gap is the entire attack surface.

A letter arrives on official-looking stationery, quoting your actual domain name and a real expiry date — both of which are public information — and asking for seventy-five dollars to renew. There is no pattern in your head to contradict it. You have no idea what your real renewal costs or who takes the payment. Paying it feels like housekeeping.

What you have actually done is transfer your domain to a different registrar at four times the price, which is legal because the small print said the letter was a solicitation rather than a bill. That sentence is there specifically so the operation stays lawful, and it is printed in the smallest type on the page.

The same structure underlies the fake directory invoice, the lookalike verification email, and the phone call about being removed from Google. In each case the target's ignorance is not stupidity — it is the entirely reasonable state of someone who deals with this twice a year.

• Never act from inside a message. Do not renew, pay, or log in via a link, a phone number, or a form in an email or letter. Open the account yourself by typing the address you normally use. This one rule defeats nearly every scenario in the drill.
• Know who your registrar actually is. Write it down somewhere you will find it in two years. Most people who fall for a renewal letter simply could not remember, and had no way to check that the sender was not them.
• Turn on auto-renew and domain lock. Between them they remove the entire category of 'you are about to lose your domain' leverage, because you are not. Both are free and take two minutes.
• Tell whoever answers the phone never to confirm details. The fake directory invoice depends on a call where someone confirmed the business address and spelling. That confirmation later becomes 'you agreed on the phone'. The correct answer to any caller asking to verify your details is that you will call them back.

Notice that none of these require judgement. That is deliberate. A well-made fake registrar email is indistinguishable from the real thing on appearance alone, so a defence based on spotting fakes will eventually fail. A defence based on never acting from inside a message does not.

The domain renewal solicitation arrives by post, quotes your real domain and expiry date, and asks for several times the market rate. The disclaimer that it is a solicitation rather than a bill is present and tiny.

The directory listing invoice claims you ordered a listing and references a phone call you do not remember. It usually threatens late fees. It is not a debt; you never entered into a contract, and one written reply stating so is the correct response.

The lookalike verification email manufactures a deadline — your listing will be removed in twenty-four hours — from a sender domain that resembles Google or your registrar without being it. Real platforms do not send twenty-four-hour deletion threats.

The transfer alarm tells you someone is stealing your domain and offers one urgent link to stop them. Genuine transfer notices come from your actual registrar and tell you to act inside your account, never through a link.

The cold SEO audit is not fraud in the criminal sense, but it uses the same machinery: an automated scan producing a frightening count of errors, most of them trivial or invented, followed by a sales call. Google does not penalise sites for the things those scans flag.

For a renewal solicitation you paid: your domain may now be at a different registrar. Log in to the registrar you originally used and check whether the domain is still there. If it has moved, contact your original registrar about transferring it back — there are dispute processes for this, and being quick matters.

For a directory invoice you paid: contact your bank or card provider. Depending on how you paid and how long ago, a chargeback may be possible. Do not pay a second one, and do not engage with escalating letters beyond one written statement that no contract exists.

For credentials you gave to a caller: change the password on that account immediately, enable two-factor authentication, and check for any pending domain transfer. Then check whether the same password is used anywhere else.

In all cases, report it to your national fraud reporting body. It rarely recovers money and it does contribute to the data that eventually shuts these operations down.