Is This Email Real? Scams That Target Website Owners

If you own a website, you are on a list. Domain ownership records are public, which means every business with a domain receives a steady stream of fake invoices, phony renewal notices, and phishing emails designed to look official.

You are not being singled out. These are sent by the thousand to anyone with a registered domain, and they work often enough to stay profitable. The good news is that nearly all of them fall apart under thirty seconds of scrutiny, once you know what to look for.

This guide covers what is circulating right now and how to check. When in doubt, forward it to us before you pay or click anything. We will tell you, at no charge, and we would much rather answer the question than clean up afterward.

The One Rule That Handles Almost Everything

If you remember nothing else, remember this.

Never act from inside the message. Do not click its links, call its phone number, or scan its QR code. If a message says your domain is expiring, open a new browser tab and sign in to your registrar directly. If it says your Facebook page is in trouble, go to Facebook the way you normally do and look for a notice there.

If the problem is real, you will find it waiting for you in the account. If nothing is there, the message was fake. This one habit defeats nearly every scam in this article, including the sophisticated ones.

Why "Check The Sender Address" Is No Longer Enough

The old advice was to look at who sent the email. That still catches the lazy attempts, and it is worth doing — a company claiming a London headquarters and 24-hour support does not send billing notices from a Gmail address.

But it is no longer sufficient. In 2026, security researchers documented a phishing operation that sent fake Facebook policy-violation notices through legitimate Google infrastructure, so the messages arrived from a real, verifiable google.com sending domain. That campaign compromised roughly thirty thousand Facebook accounts, most of them business pages and ad accounts.

A message can pass every technical check and still be a scam. That is exactly why the rule above is about where you navigate, not about what the message looks like.

Fake Domain Renewal Invoices

The most common one by far, arriving both by email and by physical mail.

You get an invoice with your real domain name on it, a reference number, an amount due of anywhere from $75 to $500, and language implying your website and email will stop working if you do not pay. It looks like a bill because it is designed to.

How to spot it:

• Read the fine print. Many of these are legally required to include a line like "THIS IS NOT A BILL. THIS IS A SOLICITATION. YOU ARE UNDER NO OBLIGATION TO PAY." It is usually buried in small type at the bottom. That sentence is a confession.
• The sender is not your registrar. These outfits use official-sounding names — Domain Networks, Domain Services, various "registry" and "listing" companies. Sounding like an authority is the entire business model.
• The price is wrong. Domain renewals typically run $12 to $25 a year. A $289 invoice is not a renewal.
• It arrived on paper. Legitimate registrars almost always email. A printed invoice in the mail feels more official, which is precisely why they use it.
• Countdown timers and pop-ups. Some versions link to a page that "looks up" your domain with fake loading messages, then claims it expires in three days regardless of the real date, with a discount expiring in fifteen minutes. Real registrars do not sell like a used car lot.

Some of these are outright fraud. Others are technically legal solicitations for a worthless directory listing. Either way you get nothing, and your actual domain is unaffected.

Domain Slamming: The Version That Actually Hurts

This one deserves separate attention because it costs more than money.

Instead of just taking a payment, the paperwork you sign or submit authorizes a transfer of your domain to a different registrar. You have not been billed for nothing — you have handed over control of the address your website and email depend on.

Untangling it means proving ownership to a company that has no incentive to hurry, and your site and email can be disrupted while you do. If a notice asks you to confirm, verify, or authorize anything about your domain, that is the moment to forward it to us rather than sign it.

Facebook And Meta "Policy Violation" Messages

Extremely common and getting better.

An email or Messenger message claims your page violated community standards, infringed a copyright, or broke advertising rules, and that it will be permanently deleted unless you appeal within 24 hours. The link opens a convincing copy of Meta's appeal process.

What gives it away:

• The deadline. A 24-hour ultimatum is manufactured panic. Meta's real processes do not work that way.
• It asks you to log in. You are already logged in to Facebook. Any page demanding your password again is harvesting it.
• Nothing appears in your actual account. Genuine enforcement shows up in your Page notifications and Business Suite. Check there, not in the email.

If they get your password, they immediately change it and enable two-factor authentication on their own device, locking you out of your own page. Recovery is slow and sometimes impossible. Worse, some of these operations then sell you "account recovery" services to fix the problem they created.

"Your Google Listing Will Be Suspended"

These arrive as robocalls, live calls, and emails, usually claiming to be Google or a Google partner, and warning that your Business Profile is unverified, about to be removed, or needs to be claimed immediately.

Google does not cold-call small businesses to threaten your listing. The callers are either selling overpriced listing management or fishing for enough access to hijack your profile — which is valuable, because a hijacked profile can redirect your calls and customers to a competitor.

Hang up. If you are worried about your profile, search your business name on Google while signed in, or ask us to check it.

A Few More Worth Knowing

• "Your website is not indexed by Google." Cold SEO pitches dressed as technical alerts. If your site is managed by us, it is indexed, and we monitor it.
• Copyright complaints about a photo on your site. Sometimes real, often a lure. The link or attachment claiming to show the infringing image is frequently malware. Forward it to us instead of opening it.
• Directory and listing invoices. Yellow-pages lookalikes billing for a listing nobody ordered. Same fine print, same worthlessness.
• Invoices for things you never bought. The FTC warned small businesses about this again in 2026. Scammers bet that a professional-looking invoice gets paid without anyone checking whether the service exists.
• Trademark warnings from overseas. A message claims someone is registering your brand name in another country and offers to stop it for a fee. Invented urgency, invented threat.

The Pattern Behind All Of Them

Different branding, same machinery. Once you see the shape, individual variations stop mattering.

• Urgency. A deadline measured in hours or days, designed to stop you from checking.
• Threatened loss. Your website goes dark, your page is deleted, your listing disappears.
• A link that bypasses your account. They need you inside their version of the login screen.
• Real details about you. Your domain name, your business address, your expiry date. All public information, and including it is the cheapest way to look legitimate.
• An unusual payment method. Wire transfer, gift cards, cryptocurrency, or a payment link that has nothing to do with your normal billing.

What To Do When One Arrives

1. Do not click, call, or pay.
2. Ask whether you have any relationship with the sender. If you cannot name them, that is your answer.
3. Check the account directly by navigating there yourself.
4. Forward it to us if anything is still unclear.
5. Delete it, or shred it if it came on paper.

Tell your staff too. These are frequently aimed at whoever opens the mail or handles accounts payable rather than the owner, precisely because that person may pay a routine-looking invoice without asking.

If You Already Paid Or Clicked

It happens to careful people. Move quickly and it is usually recoverable.

• You paid by card. Call your bank using the number on the card and dispute it. Filed promptly, these chargebacks often succeed.
• You entered a password. Change it immediately from a different device, along with the password on the email account that could reset it. Turn on two-factor authentication and sign out all other sessions.
• You authorized something about your domain. Contact us right away. The faster we move, the better the odds of stopping a transfer before it completes.
• You downloaded an attachment. Disconnect the device from your network and have it checked before signing in to anything else.

Then tell us what happened. We are not going to lecture you. We need to know so we can watch for follow-on attempts, because responding to one scam often lands you on a list for more.

How We Actually Contact You

Knowing our habits makes impersonation easier to spot.

• We will never ask for your password by email, phone, or text. Not once, not for any reason.
• We will never ask you to pay by gift card, wire transfer, or cryptocurrency.
• We do not send threatening final notices with countdown timers.
• Our invoices come from us, and you can always verify one by calling the number you already have for us rather than a number in the message.

If something claims to be from Sagentic Web Design and does not match the above, it is not from us. Tell us — we want to know when someone is using our name.

When In Doubt, Ask

There is no such thing as a silly question here. Forward the email, or photograph the letter and send it over. We will tell you what it is and what, if anything, to do about it. It costs you nothing and takes us a minute.

Not sure who your registrar is, or whether your domain renewal is actually current? Ask us that too. Our guide on how to share domain management covers how we help maintain your domain without ever needing your password.

If you have any questions, you can email us info@sagentic.com or fill out the contact form below.