Suspicious Domain Renewal Email? Five Checks Before You Pay

You are getting orders ready when an email arrives: your business domain is about to expire, and payment is needed today. The domain looks familiar. So does the logo. A colleague forwards the message on WhatsApp and asks whether accounts should pay it.

A real renewal deserves attention. A convincing message still needs checking.

For a Ghanaian shop, school or consultancy, a useful habit is to open the provider account independently and match the request to the service you actually own. These five checks help you do that without following the email's payment link.

1. Open your provider's website independently

Leave the message open for reference, but use your saved bookmark or type the provider's known website address into a new browser tab. Avoid its links, attachments and QR codes while you are unsure.

If Nakroteck manages the domain, type nakroteck.net and use Sign In. Check the browser address before entering your password. The Nakroteck sign-in page gives you access to services, billing and support.

A familiar company name in the sender field is only a clue. Ghana's Cyber Security Authority advises verifying suspicious messages through contact details you already trust; polished wording does not settle whether a request is genuine. CSA phishing guidance.

Illustrative example: a fictional Kumasi catering business uses cocoa-counter.example. Its accounts assistant receives a “renew now” message. The assistant opens the provider account separately and checks the domain there. This is a made-up example, not a customer incident.

2. Match the exact domain and the service being billed

Read the full domain, including its ending. A bill mentioning a similar name or another extension needs an explanation.

Then read what the payment buys. Domain renewal, website hosting, business email and an optional directory listing are different items. A request headed “website renewal” is too vague to approve without a description.

In Nakroteck, open Domains and select the relevant domain. Open Invoices separately and read the invoice's description, status and balance. If a staff member cannot see these sections, ask the account owner or someone with the appropriate access to check them.

If your developer bought the domain through another provider, confirm who holds that account. Having a website hosted with Nakroteck does not, by itself, establish that Nakroteck also manages its domain registration. Our domain registration guide explains the service in more detail.

An ICANN logo does not make a bill legitimate. ICANN has documented renewal messages that copy its branding, and says it does not collect domain-registration fees directly from registrants. ICANN renewal phishing alert.

3. Compare the invoice deadline with the domain's expiry

The invoice due date and domain expiry date can be different. The first is a billing deadline; the second concerns the registration. A provider may request payment early so there is time to process the renewal.

Nakroteck's renewal guide explains this distinction. It also notes that payment and completed renewal are separate steps: registrar confirmation or manual processing may still be required, including for some Ghana domain extensions.

So neither an early invoice nor an expiry date that has not yet changed proves fraud. Equally, a message saying “expires today” is not enough to approve payment. Compare it with the account record and ask for clarification if they disagree.

Do not dismiss every renewal reminder. Keep a calendar reminder of your own and verify genuine notices promptly. ICANN's renewal guidance recommends tracking expiry and contacting the provider when you are unsure of the date. Ask Nakroteck about an already-expired domain before paying for a recovery request.

4. Check how the payment is being requested

Start payment from the verified invoice in the account. Review its currency and outstanding balance rather than relying on a forwarded amount or an old price screenshot. A checkout may lead to a payment provider; that is a reason to check the transaction details, not to assume every external payment page is fraudulent.

Pause if someone asks you to tell them your account password, MoMo PIN or one-time verification code. Do not send those details by email, WhatsApp or a phone call. Ghana's Cyber Security Authority recommends confirming payment requests through trusted business contacts and keeping PINs, OTPs and banking credentials private. CSA payment-safety advisory.

For a small team, agree who checks renewal requests and who authorises payments. A forwarded screenshot should send that person to the account for verification; it should not become the approval on its own.

5. Resolve mismatches through a known support channel

If you cannot find the domain, the invoice is missing, or the description differs, stop and ask your established provider. A missing invoice alone does not prove a scam: you may be using another account or checking a service managed elsewhere.

For a Nakroteck-managed domain, open a support ticket from your account. Include the domain, the message's claimed deadline and a redacted screenshot of the request. Hide unrelated personal details, payment codes and sensitive links. Never send your password or a domain transfer code to verify a renewal.

Use the contact details on the provider's website, rather than the number printed in the questionable message. Nakroteck's contact page also explains how to get help if you cannot sign in.

Already clicked or shared information?

Stop interacting with the suspicious page. If you entered a password, change it through the genuine service and change it anywhere else you reused it. Enable multi-factor authentication where the service offers it. CSA account-protection guidance.

If you paid, contact your bank or mobile-money provider through its official channel promptly and ask what response is possible. Keep the message and transaction reference for the report; recovery is not guaranteed.

If an attachment or download may have installed software, update your device's security software and run a scan. Ask a trusted IT professional for help if you are unsure. FTC phishing guidance.

Your next step: if a renewal request for a Nakroteck-managed domain still does not match your account, sign in and open a support ticket for verification before paying that request.