The fake emails that target people who own a website

An email arrives saying your domain expires on Friday and your website will go offline unless you pay £89 today. It has your business name in the subject line and your web address in the first sentence. You have no idea who registered the domain six years ago, so you cannot say for certain that it is wrong.

That uncertainty is what the sender is counting on. Owning a website puts your name, your address and your email on several public lists, and a small industry works through those lists sending letters that look official. Four kinds turn up in small business inboxes more than the rest.

The domain renewal that is a transfer

This one comes by email and, more often than people expect, by post on headed paper. It is titled something like “Domain Name Expiration Notice” and lists your domain, an expiry date and a price for one, two or five years.

The small print gives it away as an offer to move your domain to a different company, worded so that paying it feels like keeping what you already have. Some of these firms are legally registered and do transfer the domain, at three or four times the going rate, with a renewal price that climbs after that. Others take the money and do nothing.

The tells:

• The company is not the one you bought from. Your real registrar is whoever you pay now, or whoever your web designer used. The letter names somebody else.
• The wording avoids saying “renew”. Look for “transfer”, “switch”, “listing”, “search engine registration” or “we are not your current registrar” tucked in at the bottom.
• It arrived by post. Registrars send reminders by email to the account holder. A paper letter about a domain is almost certainly a sales letter.

A real renewal reminder comes from the company that holds your domain, to the email address on your account, and it asks you to log in to their site to pay. You can check without clicking anything in the message: go to the registrar’s website by typing the address yourself, log in, and the expiry date is on the dashboard. For a .co.uk, Nominet’s WHOIS lookup on its own site shows the registrar’s name and the renewal date to anybody who asks.

If you do not know which company that is or who has the login, find out this week, while nothing is urgent. Our list of questions to ask a web designer covers getting the domain into your own name.

The Google warning that Google did not send

“Your website has been flagged and will be removed from Google search results within 48 hours.” The message has a Google logo, mentions a policy, and offers a link to “resolve the issue” or a phone number for an SEO specialist who can help.

Google does not write to you like this. It has no way of knowing your email address unless you have set up Search Console, and when it has something to say, the message appears inside Search Console as well as in your inbox. A real one is calm, names the problem, and links to Google’s own help pages. It does not set a 48-hour deadline and it does not put you in touch with somebody selling SEO.

The gentler version of the same thing is the email that says your site has “17 critical SEO errors” or is “not appearing on Google”, from somebody who ran a free scanning tool over it. Those are sales emails rather than fraud, but the number is meaningless and the fix offered is usually a monthly retainer. If you want to know where you stand in local search, our post on why your site does not rank locally explains what decides it.

To check a warning, log into Search Console yourself and open the Messages panel and the Security & Manual Actions section. If both are empty, the email was invented. If you have never set up Search Console, Google has had no way to contact you about your site.

The copyright complaint with an attachment

This is the dangerous one, because it is built to make you open a file. It often arrives through your own website’s contact form, which means it comes from your own site’s address and gets past your spam filter.

The message says a photographer or design studio has found one of their images on your site, used without permission, and that you face legal action unless you remove it. The evidence, it says, is in the linked document. The link goes to a file-sharing page that asks you to download something or sign in with your email password.

Two features give it away. The complaint never names the image or the page it appears on, because the sender has never looked at your site. A real complaint from a rights holder or their solicitor names the photograph, gives the page address, and attaches nothing you have to download to see it.

The link is the attack. Downloading the file installs software that steals passwords from your computer, and the sign-in page captures your email login. Either one hands somebody the key to your inbox, and from your inbox they can reset the password to everything else, your website included.

If you are worried that you have used an image you should not have, look through your own site’s pages. You do not need the attachment to do that.

The hosting suspension notice

“Your hosting account has been suspended due to an unpaid invoice” or “Your mailbox is full, verify your account to keep receiving email”. The link goes to a login page that copies your host’s or your email provider’s design closely.

The tell is in the address bar once you click, which is why it is better not to click. Open a new tab, go to your host’s site the way you normally would, and log in there. If an invoice is overdue or a mailbox is full, the real dashboard will say so.

What to do with one

The checks above share one habit: you never act on a link or a phone number inside the message. You go to the company by the route you already know, and you look for yourself.

A few other things help:

• Know who holds your accounts. Write down your registrar, your host and your email provider, with the logins in a password manager. Half of what makes these emails work is not knowing which company is real.
• Turn on two-factor authentication on email, the registrar and the website. A stolen password then gets the thief to a locked door. Our step-by-step guide for WordPress covers the site, and the same idea applies to the rest.
• Forward the fake to report@phishing.gov.uk. That is the National Cyber Security Centre’s reporting address, and it gets suspect sites taken down.
• If somebody has already clicked, change the email password first from a different device, then the website and registrar passwords, and tell whoever looks after your site. If the site itself starts misbehaving, what to do in the first hour goes through the order.

Where this leaves you

These emails work on uncertainty, so the defence is knowing three facts about your own website: who holds the domain, who hosts the site, and where the real notices arrive. With those written down, a fake renewal or a frightening Google warning takes two minutes to check and goes in the bin.

If you cannot answer those three questions about your own site, a free website review will find the answers and tell you whether the domain, hosting and logins are in your name.