Scam Emails Aimed at Website Owners: Fake Renewals, SEO Pitches and Threats

The day you register a domain or launch a website, a new kind of mail starts arriving. Some of it is legitimate. A surprising amount is designed to look like a bill, a legal warning or a once-in-a-lifetime marketing offer. Small business owners, churches and nonprofits are frequent targets because they often have one busy person handling everything.

Here are the most common scams aimed at website owners and how to deal with each one calmly.

Fake domain renewal notices

These look like invoices: your domain name, an expiration date and an amount due. Read the fine print and you will often find they are not from your current registrar at all. Paying may transfer your domain to a different company at a higher price, or buy a service you do not need.

How to handle it:

• Know which company your domain is actually registered with, and keep that in your records.
• Renew only by logging in to your registrar's website directly, never through an emailed link.
• Turn on auto-renew and a registrar lock at your real registrar so expiration and unauthorized transfers are less likely.

"Search engine registration" bills

Another invoice-style letter or email offers to "submit" or "register" your site with search engines for an annual fee. Major search engines do not require paid submission. You can tell Google about your site for free through Google Search Console by submitting a sitemap.

How to handle it: do not pay. If you want help with search visibility, choose a provider deliberately, not from an unsolicited bill.

"Someone is registering your brand" warnings

An email claims a company in another country is trying to register domains or keywords using your business name, and politely offers to let you claim them first. It is a pressure sales tactic. Unless you actually plan to do business in that market, you can ignore it.

Copyright and legal threats with links

These messages accuse you of using copyrighted images or violating the law, and urge you to click a link or open an attachment to see the "evidence." Some are phishing attempts or malware. Others are aggressive demand letters.

How to handle it:

• Do not click links or open attachments in an unexpected legal threat.
• Check whether the claim makes sense: do you actually use the image or content mentioned?
• If a notice seems genuine, or you are unsure, talk with an attorney before responding or paying anything.
• Keep records of where your images and content come from, including licenses, so questions are easy to answer.

Hosting and account suspension phishing

An email says your hosting, email or website account has been suspended for a billing problem or policy violation, with a link to sign in and fix it. The link leads to a fake login page that steals your credentials. Go to your provider's website directly to check your account status. Our guide on how to spot a phishing email covers how to inspect senders and links.

Too-good SEO and web design pitches

Cold emails promise first-page rankings, guaranteed traffic or a flood of backlinks. Some are just low-quality services. Others use tactics that violate search engine spam policies and can damage your site's reputation. Nobody can honestly guarantee a specific ranking on Google.

How to evaluate an offer: ask what specific work they will do, how they will report results, whether they follow Google's published guidelines and who will own any accounts they create. Vague answers and guaranteed rankings are reasons to walk away.

Unsolicited calls about your business listing

Some callers claim to be from Google or another search company and warn that your business listing will be removed unless you pay. A Google Business Profile is free to create and manage. Hang up and check your profile yourself by signing in.

Build a simple defense

• Keep a short list of your real vendors: registrar, hosting provider, email provider, website platform and any marketing help, with renewal dates.
• Put renewal dates on a calendar so surprise "expiration" notices are easy to dismiss.
• Protect your accounts with unique passwords and two-factor authentication, especially the registrar, which controls your domain.
• Route bills through one process. Someone checks that every invoice matches a real vendor and a real order before paying, as described in our guide to invoice fraud and fake payment requests.

Frequently asked questions

How do I find out who my real domain registrar is?

Check your records and past receipts first. You can also use a public domain lookup tool, often called WHOIS or RDAP, which lists the registrar for a domain.

Do I need to pay to be listed on search engines?

No. Search engines discover sites by crawling the web, and Google lets you submit a sitemap for free through Search Console. Paid "submission" services add nothing you cannot do yourself.

Should I reply to a copyright complaint email?

Do not click its links or attachments. Verify the claim against your own records, and if it appears genuine or involves a demand for money, get advice from an attorney before you respond.