Fake Website Invoices: How to Tell a Real Bill From a Scam

The envelope says Domain Name Expiration Notice. It has your company name, your web address, and a date that looks about right. The amount is not large. Someone in accounts payable has a stack of bills to clear before lunch.

That is the whole scam. It does not need to fool the owner. It needs to look routine to the person who pays routine things.

In May 2026 the Federal Trade Commission warned small businesses about exactly this: invoices for things nobody ordered, such as tech support, web address registration, and search ranking services. Some arrive stamped past due. Some borrow the name of a company you have heard of. The good news is that one short list, kept by one person, defeats nearly all of them.

They come in a few familiar shapes. The paper renewal notice is the oldest. Many are not technically invoices at all. The fine print says that paying moves your web address to a different company, usually at a higher yearly price. You did not renew anything. You switched vendors without meaning to.

The email version is newer and faster. In June 2026, the security company Malwarebytes described a campaign of urgent renewal emails that led to a fake checkout page. The page showed the business's real web address details to look genuine, then collected card numbers and personal information. Nothing was ever renewed.

Then there are the service invoices. A bill for search ranking work you never agreed to. A past due notice for tech support. A charge for a business listing that is free from the source. These rely on nobody being sure what the company actually buys.

Website costs are small, irregular, and spread across several vendors. Your web address renews once a year, or once every few years. Email is billed by a different company. Hosting may be bundled with a care plan, or not. Nobody sees all of it in one place.

The details on the fake bill are also accurate, which is what makes it convincing. When a web address is registered, much of that record is public. A scammer can look up your address and its renewal date in seconds. Accuracy is not proof that a bill is real.

And the person who set everything up has often moved on. The web designer from six years ago, the employee who handled it, the nephew. If nobody inside the company knows the real vendor's name, any official letter is plausible.

Write down every real bill your website produces. It usually fits on half a page. For each one, note the company, roughly what it costs, when it renews, and how it is paid.

The usual lines are short. The company that holds your web address registration, called a registrar. Whoever hosts or manages the site. Your email provider. Any listing, advertising, or search service you actually signed up for. If a security certificate or a form service is billed separately, add it.

Then make one change that does most of the work. Set every real renewal to pay automatically, on a company card, with the receipts going to an inbox someone reads. Once that is done, a paper invoice for your website is suspect by default. Your real vendors are not mailing you letters. They are charging a card you know about.

If you cannot fill in the first line, because nobody knows who holds your web address, that is the bigger problem. Start with who actually owns your website and get that record into an account the company controls.

Compare it to the list first. If the company is not on it, it is not a bill. It is a sales pitch or a fraud attempt, and either way nobody owes it.

If the company is on the list, still do not use anything in the message. Do not click the link, call the phone number, or scan the code. Log in through a bookmark you already had, or call the number from your own records or a past receipt. A real renewal will be waiting in the account.

If you do not recognize the sender, the FTC's advice is simple and good. Search the company name with words like review, scam, or complaint, and see what other businesses report. Then tell the FTC at ReportFraud.ftc.gov. Emails that pretend to be bills can also be forwarded to the Anti-Phishing Working Group at reportphishing@apwg.org.

Treat urgency as the warning sign. Countdown timers, same-day deadlines, and threats that your site goes dark tonight are sales tactics. A real vendor will send several reminders over weeks, and your card will simply be charged.

Call the bank or card company the same day and ask to dispute the charge. Speed matters more than embarrassment. If a card number was typed into a fake page, ask for a new card and turn on transaction alerts.

If anyone entered a login on a fake page, change that password right away and turn on two-step sign-in, where a code from a phone is needed as well. Then log into your real registrar account and confirm your web address is still there and has not been moved.

Check that too if someone paid a paper transfer notice. Your address may now sit with a company you have never dealt with. It is fixable, but do it before the next renewal, not after. An expired web address takes your site and your email down together, and the customer usually notices first.

Most of this is not a technology problem. It is an approval problem. Write one rule down: no website bill gets paid unless it matches the list, and one named person keeps the list current.

The same list protects you from the opposite mistake, a real renewal that lapses because the card on file expired. That one is not a scam, but it can cost more than any fake invoice.

When a business hands us its website, keeping track of the real renewals is part of what we handle. That way a strange letter is easy to spot. That is the arrangement behind our concierge service, but the list works for any business, with or without us.

This week, the whole test takes about an hour. Write the list. Confirm each renewal is on automatic payment. Forward the list to whoever pays the bills, with the rule attached. If the list turns up something you cannot explain, we are happy to look at it with you.