The number of ways people attempt to scam domain and website owners can be head spinning! Understanding domains and hosting is confusing enough already, and all you want to do is have your website and do your work, but unfortunately, you always need to remain vigilant to avoid being ripped off or having your domain stolen.
Scams trying to steal or over-charge people for domains have been around for a long time, but I’ve see a recent uptick in the past few months. I’m sure it won’t be the last time.
Examples of domain name and SSL scams
This one from Domain Listings (1.1 of 5 stars on the Better Business Bureau) requests $288 per year for “annual website domain listing on internet directory”.
This scam doesn’t even try to take anything from you except your money. But it sure looks like a renewal for your domain name!
Another client of my recently had a company call them offering to sell them a very expensive SSL certificate and intimating they were connected to GoDaddy (they weren’t). I don’t know what they would have done with their access had they gotten it.
In the case of the SSL scam, the website really was down due to an unrelated SSL issue, so it’s critical to be vigilant, even when people seem to know a lot of details of your technology.
Things to know
Here’s what you need to know to help avoid these types of scams:
- If you don’t pay for domain privacy (or didn’t use to), people can see who is the listed owner of any website domain. This means they can send you official looking things about your website.
- Similarly, anyone can look up the IP address that hosts your website. In many cases, this can help them figure out the company that hosts your website.
- I don’t know of any major company that sends invoices by mail or phone. Web hosting companies and domain registrars rely on email and don’t have the time to proactively reach out to you.
- Domains generally cost $10-20 per year and some companies charge another $10-20 per year for “domain privacy.” If you need advice on where to host your website or domains, we’ve got recommendations!
- I strongly recommend that you keep your domains registered under your organization’s name in an account primarily controlled by your organization. Organization’s have lost their domain and websites when their web developer disappears and they didn’t control the domain.
How to avoid scams
So what should you do if you are contacted by someone and aren’t sure if it’s legitimate?
- Contact your web developer if you have one. (Here are some tips on finding good WordPress consultants.)
- Log in directly to the company that hosts your website and/or hold the registration for your domain. Don’t even click an email link. If you need to renew or adjust your domain, you can always do that through your existing account’s dashboard. This should sound familiar, because it is the same common advice for avoiding bank and credit card scams. Go straight to the source and don’t let anyone lead you elsewhere or offer a shortcut.
Better yet, you can be proactive about maintaining your hosting and domain in accounts you actively monitor.
Every year you will receive a legitimate email reminding you to confirm the contact details on your domain. You should review these details and update them whenever they are out of date.
To make this all easier, it’s crucial that you know where your domain and hosting are located so you can evaluate these claims when something seems suspicious! If you’re not sure who your hosting company or domain registrar is, there’s no better time to go figure that out!