Domain Name Scams: How to Spot and Avoid Them When Buying

Most domain name scams work by faking urgency: a message says your domain is expiring, a listing looks too cheap to pass up, or a lookalike address hides one swapped letter. You avoid nearly all of them with two habits. Never act on a renewal or billing email by clicking its link (open a new tab, type your registrar's address yourself, and log in to check), and never send money for a domain outside of escrow. This guide covers the seven scams buyers actually run into, the exact red flags to spot, and how escrow makes a purchase safe.

What are the most common domain name scams?

The most common domain scams are fake renewal notices, domain slamming, cheap listing fraud, lookalike phishing domains, fake buyer or appraisal offers, and bogus "domain protection" fees. Most target one of two moments: when your domain is near renewal, or when you are in the middle of buying or selling one. They rely on volume and urgency rather than technical skill, because contact details are pulled straight from public records. Once you know the pattern behind each, they are easy to refuse.

How do fake domain renewal notices work?

A fake renewal notice is an email or letter that looks like an official bill and pressures you to pay before your domain "expires." Scammers scrape the domain name, registrar, and expiry date from public WHOIS and RDAP records, then send a notice that shows your real details back to you so it feels legitimate. Reported versions demand $265 or more for a multi-year lock-in, roughly 10 times a normal renewal, and are increasingly written with AI so the wording mirrors a real registrar. The tell is almost always the sender: a company claiming a professional office does not bill you from a Gmail address.

What is domain slamming?

Domain slamming is a trick that gets you to transfer your domain to a different registrar, usually at an inflated price, by disguising the transfer as a routine renewal. You receive an official-looking notice, pay what you think is a renewal fee, and by signing you have actually authorized moving the domain to the sender's service, where you then pay well above market rates every year. It is legal-adjacent junk mail rather than outright theft, but the cost adds up. The defense is simple: renew only inside your existing registrar account, never through a notice that arrives in your inbox or mailbox.

How can you tell if a domain seller is legitimate?

A legitimate domain seller will complete the sale through escrow and never pressures you to pay by irreversible wire transfer or cryptocurrency to a personal account. Escrow means a neutral third party holds your money until the domain is confirmed transferred into your registrar, so neither side can walk away with both the name and the cash. Be wary of a premium name priced far below comparable sales, a seller who refuses escrow, or one who invents fees for "certificates" or "appraisals" before the deal. Buying through an established marketplace or a reputable domain broker removes almost all of this risk.

What is a lookalike or punycode domain scam?

A lookalike domain scam uses an address that is visually almost identical to a real one, so a login or payment page looks trustworthy. Attackers register a name with a swapped letter, an added word, or accented characters that render like ordinary letters, a trick known as a homograph or punycode attack. You might see what appears to be your bank or registrar, type your password, and hand it straight to the scammer. Check the address bar carefully before logging in, and if you own a brand it pays to watch for lookalike domains impersonating your business so you can act before customers are fooled.

How do you avoid getting scammed when buying a domain?

Buy through a marketplace or broker that uses escrow, and treat every unsolicited message as unverified until you confirm it independently. Log in to your registrar directly rather than clicking email links, turn on auto-renewal so no one can manufacture urgency around your expiry date, and register important names for several years at once. When you purchase a name from another owner, insist the payment sits in escrow until the transfer completes. These few habits neutralize the entire list above, because scams depend on rushing you into an action you cannot reverse.

Are domain buying scams increasing?

Yes, largely because AI has made convincing fake notices cheap to produce at scale. Fraudsters now generate perfectly worded renewal emails that copy a registrar's tone, insert your real domain details, and vary their phrasing to slip past spam filters, so the old advice to "look for bad grammar" no longer holds. That makes the process-based defenses more important than ever: verify inside your own account, use escrow for every purchase, and never treat an inbound email as the place where a transaction happens. The tactics get slicker, but the underlying rules that stop them do not change.

The bottom line on avoiding domain scams

Domain scams prey on urgency and on payments you cannot claw back, so slow down and route money through escrow. Verify any renewal notice inside your registrar account, refuse wire or crypto payments to strangers, and buy from a marketplace that protects the transaction end to end. If you want the safest possible purchase, start with a name from our premium domains collection, where every sale is escrow-backed, and read our guide on how domain escrow keeps buyers safe.