The Deceptive Domain Registration Invoice

What you are holding, and why you should not pay it

A letter or email headed attention: important notice or domain name expiration notice, naming your domain and quoting an amount due, is almost always a solicitation rather than a bill. Do not pay it, sign it, or return it.

The reason is structural. Only one company can renew your domain: the registrar of record, the ICANN-accredited company holding the registration in the registry database, which you already have an account with. When an invoice-shaped document arrives from a company you have never dealt with, the money cannot be a renewal fee, because that sender has no registration to renew.

These mailings work because they are built from public information. Registration data for generic extensions is published by policy, so anyone can harvest domain names, expiration dates and mailing addresses and print them onto official-looking stationery. The document knows your domain for the same reason a stranger can read a phone book. The practice has names: domain slamming, a deceptive renewal notice, a solicitation in the guise of a bill.

Two different things get sold in the same envelope

Notices of this shape carry one of two payloads, and telling them apart decides what you do next.

• A transfer dressed as a renewal. The fine print, usually on the reverse or in the smallest type on the page, describes moving your domain to a different registrar, and paying authorizes the move. Under ICANN's Transfer Policy a completed transfer adds a one-year extension, so nothing visibly breaks. What changed is who controls the name and what you are charged next year.
• An unrelated service dressed as an obligation. The document is not about registration at all. It sells search engine optimization, a directory entry, or a listing of your web address in a database of the seller's making. The domain printed on the page is decoration, borrowed to make the invoice look owed.

The second kind sometimes prints a domain that is not even yours: your name with a different extension, or a near variant. Both arrive close to a real expiration date, because that date is public. The timing is the most persuasive thing about them and the least meaningful.

The sentence a mailed solicitation is required to carry

US postal law addresses this exact document. Under title 39 of the US Code, section 3001(d), matter that reasonably could be construed as a bill or statement of account due, but that is in fact a solicitation for an order of goods or services, is nonmailable unless it carries a notice on its face: this is a solicitation for the order of goods or services, or both, and not a bill, invoice, or statement of account due. You are under no obligation to make any payments on account of this offer unless you accept this offer. Words to the same effect may be substituted, but the notice must be in conspicuous and legible type, set off by typography, layout or color.

That is a test you can run in five seconds. Turn the page over, look for a sentence telling you this is a solicitation and that you owe nothing, then read where it sits: a compliant notice is set off and legible, not six-point gray at the foot of the reverse. It hands you no penalty to threaten anyone with, saying only that non-compliant matter is nonmailable; the Federal Trade Commission Act reaches further, asking whether a document's overall impression is likely to mislead.

Confirm who your registrar actually is

Before deciding anything, look up the registration data for your own domain. ICANN operates a public lookup, and every generic-extension registry publishes the same labeled fields. Three settle it.

• Registrar and Registrar IANA ID name the accredited company of record. If the sender of your notice is not that company, it cannot be billing you for a renewal, whatever the document says.
• Registry Expiry Date is the date the registry holds. A mismatch tells you the sender is using stale harvested data; a match tells you only that public data is public.
• Domain Status carries the EPP status codes, the standardized flags a registry publishes about a name. Two matter here: pendingTransfer means a request to move the domain to another registrar is being processed, and clientTransferProhibited means your registrar is set to reject transfer requests, which is the state you want by default.

If the notice claims to come from a governing body, that settles it too. ICANN has stated that it will never send registrants a domain name renewal request message, and never collects fees from registrants directly.

What a genuine expiration notice looks like

Real renewal reminders are mandatory, and they look nothing like a stranger's invoice. ICANN's Expired Registration Recovery Policy requires your registrar to send at least two before the domain expires, one approximately a month prior and one approximately a week prior; ICANN's guidance adds a third within five days after expiration.

Four things distinguish it from a solicitation. It comes from the company named in the Registrar field. It references an account you can log into. It matches the Registry Expiry Date, because your registrar is the source of that date rather than a reader of it. And it points you into that account rather than to a remittance envelope. The same policy requires registrars to publish renewal fees, post-expiration renewal fees where they differ, and restore fees, so the cost of renewing with your own registrar is checkable first.

One widespread misconception is worth correcting: ignoring one of these notices does not put your domain at risk. Your renewal obligation runs to your registrar, unaffected by what arrives in your mailbox. If the domain genuinely is close to expiring, renew inside your registrar account rather than answering the paper.

What US regulators have actually done about these mailings

In December 2003 the Federal Trade Commission sued Domain Registry of America, Inc., an Ontario company, in the United States District Court for the Southern District of New York, and the court entered a stipulated final judgment and permanent injunction. The FTC alleged mass mailings designed to resemble renewal notices from the recipient's existing registrar, when responding in fact transferred the registration elsewhere. The order names the deception exactly: it bars representing that a transfer is a renewal.

In June 2008 the FTC brought charges in federal district court in Chicago over mailings sent under the name Internet Listing Service, resolved in August 2010 with settlements, a default judgment and a permanent injunction. Per the FTC, those invoices appeared to come from the businesses' existing registrar, listed the recipient's own domain or a slight variation of it, were presented as annual website address listing renewals, and promoted purported search engine optimization services. That is the US precedent for a mailing pairing a domain invoice with an SEO offer.

ICANN has acted on its own contracts as well. On 18 July 2014 ICANN Contractual Compliance issued a notice of breach of the Registrar Accreditation Agreement to Brandon Gray Internet Services Inc. over deceptive notices sent by a reseller, citing section 3.12.7 and the Registrants' Benefits and Responsibilities Specification; a suspension issued the same day barred that registrar from creating new registrations or accepting inbound transfers from 12 August to 17 October 2014. ICANN's quoted standard is the useful part: registrants shall not be subject to false advertising or deceptive practices, including deceptive notices and hidden fees. A registrar answers for what its resellers mail.

These are dated actions against the parties named in them. They say nothing about any company mailing today, which is why this guide gives tests rather than names. Sources: FTC, August 2010 and the ICANN breach notice of 18 July 2014.

If you already signed, paid, or the domain moved

Check the status codes first. A domain showing pendingTransfer is in flight, so contact the registrar of record — the company you still have an account with — immediately and in writing, and ask it to deny the transfer. The Transfer Policy publishes no deadline for a registrant to withdraw, so do not accept a claimed one and do not wait to test it.

Understand what you signed. The Transfer Policy requires the gaining registrar to obtain express authorization from the registered name holder or administrative contact through a Form of Authorization, the standardized document authorizing a move between registrars, and a signature returned with a payment is capable of being that authorization. That registrar must produce a copy to the losing registrar within five calendar days of a request, so if you dispute authorizing anything, ask your own registrar to demand it.

If the transfer completed, the name is not lost. It sits at another registrar with a year added to its term, and can be moved back, subject to the Transfer Policy's sixty-day restriction after a prior transfer and the separate sixty-day lock after a change of registrant. Plan for a wait, not an instant reversal, and once the name is back set a registrar lock, which ICANN recommends to block attempts to transfer or delete a domain.

Two situations call for a lawyer rather than a support ticket: a payment large enough to pursue, and a registrant name that was changed rather than a registrar. This guide describes what the policies say; it is not legal advice.

Reporting it, stopping the mail, and the invoices that follow

Report it, though that will not return your money; recovery comes from your registrar, your card issuer, or a court.

• The FTC takes reports at reportfraud.ftc.gov.
• The US Postal Inspection Service is the channel if it came by mail.
• ICANN Contractual Compliance takes complaints about transfers and renewal handling, but only where an accredited registrar or its reseller is involved, and only for generic extensions. ICANN states that its authority is limited to its own agreements and that it cannot return a lost domain to you.
• Your state attorney general handles deceptive practices under state consumer protection law.

Getting off the list is two problems. For email, the CAN-SPAM Act requires a clear and conspicuous opt-out mechanism, requires the sender to honor it within ten business days, and forbids charging a fee or asking more than an email address. For printed mail there is no equivalent right, and a removal request mainly tells a mailer that your address is live. Because the list comes from registration records rather than any relationship with you, the durable answer is a rule inside your organization, not a request to the sender.

Expect company. The US Patent and Trademark Office warns that unaffiliated companies send trademark and patent owners invoice-shaped notices with inflated fees, often headed patent cancellation notice or important notification, and offers the same test: official correspondence comes only from the USPTO's Alexandria, Virginia address and uspto.gov addresses. The FTC separately describes directory listing scams, in which the recipient pays for advertising that does not exist.

The defense that works is procedural rather than clever. One person authorized to approve domain spending, one registrar account everyone knows the name of, and a rule that no domain invoice is paid unless it appears inside that account, retires this category of mail.