“Your domain is expiring” and the fake hosting invoice: how to spot the scam in 2026
If you get an email or a phone call saying your domain is about to expire, or that you need to pay a hosting invoice immediately, there’s a good chance it’s a scam. Fraudsters count on the fact that you don’t know your domain’s expiry date off the top of your head, and that you’d rather pay than lose your website. There is only one reliable way to check the real situation: log in to your provider’s account at its address, typed in by hand — never through the link in the email. If what you see there doesn’t match the message, bin it.
Contents
- Why are domains and hosting a scammer’s favourite?
- The fake hosting invoice: when a real company’s name is misused
- How to spot it: the tell-tale signs
- How to check the real status in 30 seconds
- Two typical cases from practice
- What to do if you’ve already paid or handed over your details
- How to prevent the next one
In 2026, two waves are running side by side against website owners: “your domain is expiring” scare tactics by phone and email, and fake hosting invoices that misuse the names of well-known providers. In recent weeks, several of our clients have told us they received messages like these — some simply had a feeling something wasn’t right and asked us before doing anything. That’s exactly why this is worth reading to the end: recognising the scam is the best protection.
Why are domains and hosting a scammer’s favourite?
Because these two things keep your website alive, and everyone is afraid of losing them. The scammer doesn’t need to be a genius — creating time pressure and fear is enough. “You have 24 hours or your domain will be deleted” — and you click before you think.
Domains are renewed for a fixed period, and reputable registrars warn you by email well before the expiry date, usually more than once. They don’t ring you from an unknown number, and they don’t send panic-inducing links demanding immediate payment.
Trustworthy registrars notify you about expiry by email, well in advance — they don’t try to scare you over the phone into paying immediately.
The fake hosting invoice: when a real company’s name is misused
The most common version we see is a fake invoice that misuses the name of a well-known hosting provider. Importantly, the provider itself has not been hacked — the scammers simply use the name of a familiar, trusted company to look credible. Hosting providers themselves warn that phishing emails are sent in their name from unrelated email addresses, asking for payment and directing you to a fake website where you’re supposed to pay an “invoice”.
The pattern is familiar: at first glance, the email seems to come from a legitimate address with convincing wording, and the link inside takes you to a deceptively similar website. There, pop-ups and urgent messages pressure you to pay immediately or enter your card details.
Hosting providers warn about it openly: fake phishing emails asking for payment are circulating in their name — don’t click the links in them.
How to spot it: the tell-tale signs
You don’t need to be an IT specialist to spot these emails. Here are a few recurring signs that hosting providers and the UK’s National Cyber Security Centre (NCSC) also warn about:
– Urgency and threats. “Immediately”, “within 24 hours”, “or it will be deleted”. Genuine providers don’t work with deadlines like these.
– A link in the email that pushes you to pay. A button or link that takes you straight to a payment page. You can always see your real invoice in your own account, not via a link you received by email.
– A suspicious sender address. Look carefully at the sender’s full email address — chances are it only *resembles* the real one (an extra letter, a different domain).
– An unexpected attachment. The NCSC specifically warns about emails that look official but carry malicious attachments.
– A request for card details or a password. A reputable provider will never ask you for your password or full card details by email.
If even one of these applies, stop dealing with the email — open your provider’s website separately and check there.
How to check the real status in 30 seconds
The rule is simple: never start from the email. Instead:
1. Open a new browser tab and type in your registrar’s address by hand, or use a bookmark you saved earlier yourself.
2. Log in to your account and check the real expiry date of your domain and hosting, and any open invoices.
3. If you want to be absolutely sure, you can also look up your domain’s registration details with a public WHOIS lookup (for .uk domains, Nominet’s WHOIS service).
4. If the details in the email don’t match what you see in your account, it’s a scam. Delete it and don’t click anything.
Those 30 seconds may test your patience more than a quick click — but they’re far cheaper than a drained bank card.
Two typical cases from practice
The “your domain is expiring” phone call. One of our online shop clients got a call telling them to pay for their domain renewal urgently or lose it. The caller knew the company name and the domain — which is what made it seem credible. But the real registrar never calls its customers like this. The client didn’t pay; they logged in to their account instead: the domain was still valid for months.
The fake hosting invoice by email. Another client received an invoice in the name of their hosting provider, with a link that looked like a PDF. The address was almost right and the wording sounded natural. What raised suspicion was that the email pushed for immediate payment via an external link. We checked the real account together — there were no open invoices at all. The email went in the bin.
Neither case needed any expertise, just one reflex: *check first, pay later.*
What to do if you’ve already paid or handed over your details
If you’ve been caught out, speed matters:
– Call your bank immediately, ask them to block your card, and try to get the payment stopped or recalled.
– Change the password of every account whose details you may have entered on the fake site.
– Report it to Action Fraud (actionfraud.police.uk; in Scotland, to Police Scotland on 101), and forward the suspicious email to the NCSC at report@phishing.gov.uk — that way you help protect others too.
– If you opened an attachment, run a virus scan on your computer.
There’s nothing to be ashamed of — these emails work precisely because they are professionally made. What matters is that you act in time.
How to prevent the next one
The best protection is never ending up having to make that decision. Set up auto-renewal for your domain and hosting, so their fate never depends on a single email. Bookmark your provider’s login page, and teach your colleagues the simple rule too: when asked to pay, we check in our own account first — never via the link in the email.
As part of the WPShield maintenance plan, this is exactly what we take off your plate: we keep an eye on domain and hosting notifications and filter out suspicious fake emails before they can panic you.
Received an email like this and not sure whether it’s genuine? Send it over to us, and as part of a free quick security check we’ll go through it with you in 15 minutes, before you pay anything. Better to ask once than to sort it out with your bank afterwards.
Frequently asked questions
If I get an email like this, is my domain really expiring?
Not necessarily. Scammers rely on the fact that you don’t know your expiry date off the top of your head. Only check the real expiry date by logging in to your provider’s account at its address, typed in by hand — never via the link in the email.
How do I check my real domain and hosting invoices?
Log in to your registrar’s or hosting provider’s account directly from your browser, and check your invoices and expiry dates. You can also look up a domain’s registration details with a public WHOIS lookup. If the details in the email don’t match what you see in your account, it’s a scam.
Who sends the fake hosting invoices?
Scammers who misuse the names of well-known hosting providers and send from unrelated email addresses. Hosting providers themselves warn that fake phishing emails asking for payment are sent in their name, and that these contain links pushing you to pay.
What should I do if I’ve already paid a fake invoice?
Call your bank immediately, ask them to block your card and try to get the payment stopped or recalled. Change the password of every account whose details you may have entered on the fake site, report it to Action Fraud and forward the email to report@phishing.gov.uk.
Does a genuine provider send invoices as attachments?
Usually not. Official notifications typically direct you to your own account and don’t send unexpected .zip or executable attachments. The NCSC specifically warns about official-looking emails carrying malicious attachments.
How can I avoid falling for this?
Don’t click payment links in emails, always log in at the provider’s own address, and set up auto-renewal for your domain and hosting. If you’re unsure, ask us for a free quick check before you pay anything.
