Letter from Domain Name Services or Domain Listings? Read this before you pay

This week our sister company, a local alarm business in Reno, got two of these letters in the same week, from two different companies. Both had the real domain name and business address printed on them. Neither company has anything to do with the business, and its domain renews for under $20 a year at its real registrar. If it happened to us, it is happening to plumbers, cleaners, roofers and alarm companies all over the country, and some of them are paying.

The two letters we got, and what they want

Everything below is copied from the letters themselves.

1. "Domain Name Services" (rvmx.com): $265

• Headline: "Domain Name Expiration Notice," with a "Reply Requested By" date about seven weeks before the domain's real expiration date.
• What it asks: $265.00 for a "5 Year" term, by check payable to "Domain Name Services," by card, or at rvmx.com/paynow. That is $53 a year, for a domain that renews for around $10 to $25 a year where it already is.
• What it really is: an offer to move the domain to them. In its own words: "now is the time to transfer and renew your name from your current Registrar to Domain Name Services."
• The pressure line: "Failure to renew your domain name by the expiration date may result in a loss of your online identity."
• The fine print: "This notice is not a bill … You are under no obligation to pay the amounts stated below, unless you accept this offer."

2. "Domain Listings" (domainlistings.org, PO Box 42549, Las Vegas, NV): $288

• How it looks: the domain name in large letters, a reference ID, a "Service Period," a "REMIT PAYMENT BEFORE" date, a total and a tear-off "remit with payment" stub.
• What it asks: $288.00 a year for an "Annual Website Listing," "24/7 x 365 Worldwide Customer Exposure" and "Priority Direct Support."
• What it really is: nothing to do with your domain. In its own words: "We are not affiliated with domain registration services and do not register or renew domain names."
• The fine print: "This is not a bill. This is a solicitation. You are under no obligation to pay the amount stated above unless you accept this offer."

Paying the first moves your domain to a company charging several times the normal price. Paying the second buys a "listing" and does nothing at all for your domain, which still has to be renewed with your real registrar.

How the domain renewal scam works

When you register a website address, your contact details can end up in public domain records (called WHOIS). Scam mailers download those records in bulk and print letters with your exact domain name, business name and mailing address. The letter is designed to look like a normal invoice: a logo, an account number, a due date, a tear-off payment slip, sometimes card logos and a barcode.

Somewhere in small print, usually on the back, it says something like "this is a solicitation, not a bill" or "you are under no obligation to pay." That line is there to protect the sender, not you. The bet is that a busy owner, or whoever pays the bills, will see "domain renewal," see a due date, and pay it.

ICANN, the body that oversees domain names, lists three goals behind fake renewal notices: getting you to pay a fee you don't owe, getting you to move your domain to a different company without realizing it (known as "domain slamming"), and getting your login details or transfer code so your domain can be taken. In 2003 the U.S. Federal Trade Commission went after a company over exactly this kind of mailing, and the letters have never stopped.

Red flags on a domain renewal letter

• It is from a company you have never heard of. Your real renewal comes from the company you bought the domain from, usually by email and inside your account.
• The price is wild. $100, $200, $300 or more for one year, when a normal .com renews for around $10 to $25.
• It came on paper. Real registrars almost never mail paper renewal bills.
• It uses urgent words. "Final notice," "expiration," "loss of your online identity," "act now."
• The small print says "solicitation" or "not a bill." A real renewal is a bill for something you already own.
• It asks for a transfer code (also called an authorization or EPP code), or asks you to unlock your domain. A renewal never needs either.
• It offers a different ending than yours. For example, a .net or .us when you own the .com, worded so it looks like a renewal.

What to do if you got one

1. Don't pay it, don't scan the code and don't call the number on it.
2. Find your real registrar. Go to lookup.icann.org, type your domain, and it shows which company your domain is really with and when it expires.
3. Log in to that registrar yourself (type the address, don't use a link from the letter). Check the expiration date and turn on auto-renew so it never lapses.
4. Make sure your domain is locked (often called "registrar lock" or "transfer lock") and never share your transfer code unless you are the one moving it.
5. Turn on privacy protection if your registrar offers it, so your name and address aren't in the public records the mailers use.
6. Tell whoever pays your bills. These letters work best when the person opening the mail isn't the person who manages the website.
7. Report it. File with the FTC at reportfraud.ftc.gov and, since it came through the mail, the U.S. Postal Inspection Service at uspis.gov. Keep the letter and the envelope.

Already paid one?

Call your bank or card company right away and ask about disputing the charge; tell them it was a solicitation made to look like a bill. Then log in to your real registrar and check that your domain is still there, still yours, and still locked. If anything was changed or moved, contact your registrar's support immediately. And still renew with your real registrar: paying the letter usually does nothing to keep your actual domain from expiring.

A simpler way to keep your domain safe

With FieldStacker you can get a .com or .net for $15, and it renews for free while your plan is active, so there is no renewal bill to watch for at all, real or fake. Your website, business email and domain live in one place, and if a letter ever claims your FieldStacker domain is about to expire, you'll know it's not from us.