Domain Renewal Scam or Real Invoice? What to Check First
Priya opens the Monday mail with a coffee going cold beside her keyboard. Between the power bill and a supplier statement sits a letter headed "Domain Name Renewal Notice". Your business name is printed across the top. There are card logos, a tear-off payment slip, a barcode and a due date ten days out. Nobody told her who set up the website years ago, but the letter looks official, so it goes on the pay-today pile. That pile is exactly where a domain renewal scam is designed to land, and plenty of Australian offices have paid one without a second look.
Why busy offices keep paying fake renewal invoices
Regulators have been chasing this for years. In a media release dated 15 June 2018, the ACCC announced that the Federal Court had ordered Domain Corp and Domain Name Agency, trading as Domain Name Register, to pay $1.95 million in combined penalties. Between November 2015 and at least April 2017, the two businesses sent about 300,000 unsolicited notices that looked like renewal invoices. They were offers for brand new domain names priced at $249 to $275. Businesses paid about $2.3 million, according to that same ACCC release.
The ACCC was blunt about who gets targeted. Small businesses, it said, because these operators count on a thin understanding of how domain names work, or on a busy office. Neither is a failing. Most owners registered their domain once, a long time ago, and haven't thought about it since. Someone else opens the mail and pays the bills. That gap between who knows and who pays is the whole business model.
How do you tell a fake domain renewal invoice from a real one?
Check who sent it and what it's selling. A genuine renewal comes from the provider you already pay, for the exact domain you already use. Fake notices tend to come from an unfamiliar company and offer a lookalike name, such as yourbusiness.com when you own yourbusiness.com.au. If either detail doesn't match, don't pay it.
Scamwatch describes the same tactics in its alert on unsolicited registration offers: letters dressed up as invoices, complete with card logos, tear-off slips and barcodes. The trick sits in the extension. A .com and a .com.au are different names and aren't interchangeable, so paying for the .com does nothing to keep your .com.au running. According to that Scamwatch alert, the ACCC received more than 100 complaints from small businesses about these letters in 2016.
A quick comparison sorts most cases. Pull up the last genuine domain invoice in your accounts system and hold it next to the letter. Different company name? Different extension? Different price? Set the letter aside and ring your usual provider on a number you already have on file.
Who holds your .com.au domain, and is it you?
Whoever is listed as registrant on the licence holds it, and that may not be your business. Domains are often registered by a former web agency, by a founder under personal details or by a staff member who has since moved on. Until you confirm the registrant and the provider, you can't be sure any renewal notice is legitimate.
Start with the expiry date. auDA's password recovery tool at pw.auda.org.au will show when your licence runs out, which tells you straight away whether a "renewal due" letter even makes sense. For a fuller picture, auDA offers a registry search request. An authorised representative with proof of identity can ask for a list of every .au domain linked to the organisation's company name, ABN, ACN or trade mark. That's handy for businesses where names were bought over the years through different providers, or by different employees using their own details.
If the registrant turns out to be an old agency or an ex-employee, deal with it now while the domain is live. Talk to your current provider about getting the licence into the business's name, so the person paying for renewals is also the person who owns the asset.
What happens if your .com.au expires?
Once a .au licence expires, there's a 30-day grace period to renew, but your website and email stop working during it. If nobody renews within those 30 days, the name is removed and anyone can register it. For most small businesses that means lost enquiries within hours and a scramble to get back online.
auDA's guidance on renewing a .au name sets out the basics. Licence terms run from one to five years, and you can renew up to 90 days before expiry through your .au provider. You also need to keep meeting the eligibility rules, which for a .com.au means an Australian presence such as an ABN. Keep those details current.
Email is usually where the pain shows first. Quotes, invoices, supplier replies and password resets all stop arriving, and if your mail setup is already shaky you may be dealing with messages landing in spam on top of an outage.
Search visibility is the slower loss. Years of rankings and links point at that one domain, and a lapse can leave you wondering why your site isn't showing for searches it used to win. When Searchline takes on a new website or SEO client, one of the first checks is who holds the domain and when it expires, because everything else we build sits on top of it.
What to do when the next domain renewal notice lands
Don't pay from the letter. Flag any domain-related mail for review by whoever manages your website, as Scamwatch recommends.
Compare the sender with your usual provider, and the domain extension with the one on your website and email addresses.
Contact your provider directly using details from your own records, never the phone number or link printed on the notice.
Check your real expiry date at pw.auda.org.au.
Limit who can pay invoices, so domain bills reach one person who understands the setup.
Renew inside the 90-day window instead of waiting for the final week.
Put ten minutes in the diary this week. Look up your expiry date, confirm the registrant and write both on a sticky note beside whoever opens the mail. The next fake invoice will be far easier to spot once someone in the office knows what the real one looks like.
Common questions
Is a .com the same as a .com.au?
No. They're separate domain names with separate registrations, and owning one doesn't protect the other. Scamwatch specifically warns about letters selling a .com to businesses that already hold the matching .com.au. Unless you've decided you want both, an unsolicited offer for the other extension can go in the bin.
How early can I renew a .com.au domain?
auDA allows renewal up to 90 days before expiry, through your .au provider. Terms run from one to five years. You'll still need to meet eligibility rules at renewal, which for a .com.au means an Australian presence such as an ABN.
What if an old agency registered our domain?
Confirm the registrant and provider first, then ask your current provider how to move the licence into the business's name. If you're unsure how many domains you have or where they sit, an authorised representative can lodge an auDA registry search request with proof of identity. Do it before the next renewal date, while the old contact still answers the phone.
