Spotting & Avoiding Domain Scams

Understanding avoiding domain scams is the foundation of this guide. Below we break it down step by step so you can act with confidence.

The money in domain trading is exactly what makes it a target. Deals are high value, done remotely between people who never meet, and settled with payments or domain transfers that are hard or impossible to reverse once they go through. A single successful scam can cost you a five-figure domain, pull a refund straight out of your bank account weeks after the fact, or hand an attacker the keys to your entire portfolio in one click. The people running these scams are patient and professional. They study how marketplaces work, they copy real logos and dashboards pixel for pixel, and they count on sellers and buyers being in a hurry, short on experience, or quietly flattered by an offer that feels too good to question.

The reassuring part is that almost every domain scam is a variation on a small handful of moves: get you to trust a fake middleman, pay you with money that can later be clawed back, talk you into paying a fee or an appraisal up front, or trick you into typing your password into a page you do not control. None of them are clever once you can see the shape of the attack. This lesson walks through each one, how the mechanics actually work, and the specific habits that turn you from an easy mark into a hard target, from how real escrow is supposed to flow, to how you lock down the registrar account that controls everything you own.

Avoiding Domain Scams: How Real Escrow Works, and Why You Never Leave It

Escrow is a licensed, regulated middleman that holds the buyer's money until the domain is confirmed transferred, and only then pays the seller. In domains the dominant name is Escrow.com, which is licensed and regulated as a money transmitter in the United States, and the major marketplaces such as Afternic, Sedo and Atom either run their own escrow-backed transfer or plug straight into it. The flow is fixed and worth memorizing: the buyer funds escrow, escrow confirms the money has actually cleared, the seller pushes or transfers the domain, the buyer gets an inspection window to confirm control, and only then does escrow release the funds. Fees are small relative to the protection, commonly around 3.25 percent with a modest minimum, and the two sides agree in advance who pays, often a clean split. Every scam in this lesson is, at its heart, an attempt to get you to step outside this one flow.

It also pays to know the two transfer mechanics. An account-to-account push at the same registrar is usually instant and free and leaves a clean internal record, so prefer it when both parties are on the same platform. A full inter-registrar transfer needs the authorization code and can take up to five days, and ICANN's rules impose a 60-day lock after a registration or a prior transfer, so build that waiting time into the deal rather than letting a counterparty use it to rush you.

• Buyer funds escrow first; the seller never transfers the domain before escrow confirms the money has truly cleared, not merely been sent.
• Use an account-to-account push at the same registrar when you can, since it is instant, free and fully logged.
• Keep the price, the fee split, the auth code handling and every message inside the escrow platform or a written record.
• Never release funds early as a favor, and never move the final step off-platform, no matter how reasonable the reason sounds.
• If anyone pressures you to skip escrow on a deal worth four figures or more, treat that pressure itself as the scam.

Fake and Spoofed Escrow Sites

The most expensive scam in the business is a counterparty who insists on using their escrow service, then sends a link to a site that looks like a real escrow company but is controlled by them. You log in, see a convincing dashboard showing the buyer's funds deposited and pending, you transfer the domain, and the money never existed. The tells are in the address: lookalike spellings like escrovv dot com or escrow-secure dot net, or a trusted brand demoted to a subdomain such as escrow dot com dot payment-verify dot info, where the real owner of that address is payment-verify dot info. The defense is a single rule you never break. You choose the escrow provider, and you reach it by typing the address into your own browser or using a bookmark you made yourself, never by clicking a link that arrives in an email, a chat or a marketplace message.

• You pick the escrow company; a counterparty who refuses a well-known one and demands their own site is almost always running this exact scam.
• Reach the escrow site only by typing the address yourself or using your own bookmark, never a link someone sent.
• Real escrow shows funds as secured or cleared inside the genuine dashboard you logged into directly; a screenshot or a figure on an unfamiliar site proves nothing.
• Read the full address right to left: the real owner is the part just before the first single slash, not whatever brand was pasted in front of it.

Overpayment, Chargebacks and Reversible Payments

Reversible payments are the trap on the selling side. Credit-card chargebacks are commonly allowed for around 120 days under card-network rules, and longer in some dispute categories; PayPal disputes, including friends-and-family, can run up to 180 days; and a cashier's or personal check can bounce or prove forged a week or two after your bank has already let you withdraw the funds, leaving you liable for the full reversal. In every case the money can be pulled back long after you handed over the domain. The overpayment version adds a hook: the buyer accidentally pays too much and politely asks you to wire back the difference, then the original payment bounces or is charged back, so you lose the refund and the domain at once. Professionals sidestep this whole category by accepting only payment that is final once cleared, and by never trusting a balance that can still be reversed.

• Treat PayPal, credit cards, and personal or cashier's checks as reversible; all can be disputed, reversed, or forged after the fact.
• Prefer an escrow release, or a bank wire you have confirmed has actually landed and cleared in your account, not just been 'sent'.
• Never refund an overpayment until the original payment has fully and irreversibly cleared, which for checks can take weeks.
• A buyer who overpays and then urgently wants the difference back is running a scam, not making an honest mistake.

Fake Buyer Inquiries: Phishing and Upfront-Fee Traps

Not every attack targets the payment; many go after your account or your wallet directly. The phishing version arrives as a flattering inquiry for one of your domains with a link that asks you to verify ownership, complete an appraisal, or sign in to accept the offer. The link leads to a pixel-perfect copy of your registrar or marketplace login, and the moment you enter your credentials the attacker uses them to transfer your domains out from under you. A genuine buyer never needs you to log in through a link they supply, so ignore the links entirely, open your registrar or marketplace by typing the address yourself, and look for the inquiry there.

The upfront-fee version is quieter and catches experienced sellers too. The 'buyer' is keen, then explains that their company or accountant requires a certified appraisal from one specific service before they can pay, or that you must pre-pay an escrow, release or transfer fee to unlock the deal. You pay the appraisal site its hundred or two hundred dollars, or wire the 'fee', and the buyer evaporates, often because the buyer and the fee-collecting site are the same operation. The rule is simple: real escrow deducts its fee from the transaction itself, and a legitimate buyer never asks the seller to pay a fee or buy an appraisal first.

• An inquiry that asks you to log in through its link is phishing; open your account by typing the address yourself and check for the offer there.
• No real buyer requires you to pay for a 'certified appraisal' from a site they chose; that is a kickback scam, not due diligence.
• Escrow fees come out of the deal, never as a payment the seller sends up front to 'activate' or 'release' it.
• Hover is not enough on mobile; when in doubt, do not click, and navigate to the platform independently.

Stolen Domains and Verifying the Counterparty

On the buying side, the quiet danger is acquiring a domain that was stolen from its rightful owner. When the theft is discovered, the registrar can claw the name back under ICANN's Transfer Dispute process, and you are left without the domain and without your money, especially once the name has been pushed to a registrar in another country, where recovery is slow and often hopeless. The warning sign is a premium domain priced well below market from a seller who is in a hurry and keen to move off-platform. Note that public WHOIS has been largely redacted since GDPR took effect in 2018, so current ownership is usually hidden; use a historical WHOIS or domain-history service to see how and when the name actually changed hands before any money moves.

• Check the domain's history, not just current WHOIS; a high-value name that just changed hands or has a murky past deserves real scrutiny.
• Buy through a reputable marketplace or escrow that performs seller verification and handles the title transfer.
• Be wary of any seller who refuses escrow, rushes you, or cannot clearly explain how and when they acquired the name.
• For significant purchases, confirm the seller actually controls the domain at the registrar, and that it is not under a transfer lock dispute, before funds are released.

Locking Down Your Registrar Account and Stopping Wire Fraud

Your registrar account is the master key to your whole portfolio, so you harden it like one. Turn on two-factor authentication using an authenticator app rather than SMS, which can be defeated by a SIM swap, and protect it with a long, unique password kept in a password manager. Switch on the registrar transfer lock, the clientTransferProhibited status, on every valuable domain so no transfer can even begin until you deliberately unlock it, and keep the authorization code secret, since that code plus an unlocked name is all a thief needs. For your highest-value domains, ask whether the registry offers a Registry Lock, a premium service that blocks even automated changes until you clear a manual, out-of-band verification such as a phone call. Separately, guard against wire-fraud redirection, the domain world's version of business email compromise, where an attacker who has been quietly reading your email thread sends a last-minute message with new, updated bank details. Confirm any payment instructions out of band, by calling a number you already had on file, never a number supplied in the same email.

• Enable app-based 2FA on your registrar and every marketplace account, and avoid SMS codes wherever you can.
• Keep the transfer lock on and the auth code private; the 60-day lock after a registration or transfer is a safety feature, not an annoyance.
• For your crown-jewel names, add a Registry Lock so no change happens without manual, out-of-band verification.
• Verify any change of bank or wire details by phoning a number you already trusted, before sending a single payment.
• Use a dedicated email address with its own strong 2FA for all domain accounts, since whoever controls that inbox can reset everything else.

Frequently asked questions

A buyer wants to pay by PayPal friends and family or mail a cashier's check. Is that safe?

No. PayPal payments, including friends and family, can be disputed for up to about 180 days, and cashier's checks can bounce or turn out to be forged a week or two after your bank already let you withdraw the funds, leaving you liable. Both can hit long after you have transferred the domain. Insist on a licensed escrow service or a bank wire you have confirmed has fully cleared. The small escrow fee is far cheaper than losing both the domain and the money.

The buyer insists on using an escrow site I have never heard of. Should I agree?

No. In a legitimate deal you choose the escrow provider, and you reach it by typing the address yourself rather than following their link. A counterparty who refuses a well-known escrow and demands their own site is almost always running a fake-escrow scam designed to show you a dashboard of funds that do not exist. Stick to Escrow.com or the marketplace's own built-in escrow, and reach it from your own bookmark.

A buyer says their company needs a certified appraisal from a specific site before they can pay. Is that normal?

No, that is a classic upfront-fee scam. A real buyer does their own valuation and never requires you to buy an appraisal from a site they picked, because the buyer and that appraisal site are usually the same operation collecting your hundred or two hundred dollars before vanishing. The same goes for any request that you pre-pay an escrow, release or transfer fee: genuine escrow deducts its fee from the transaction, never as a payment the seller sends first.

Someone is selling a great domain well below market. How do I know it is not stolen?

Slow down, because a premium name priced far under market from a rushed seller is a textbook sign of a stolen domain. Public WHOIS is mostly redacted since GDPR, so use a domain-history service to see how the name changed hands, insist on a reputable marketplace or escrow that verifies sellers and handles the title transfer, and confirm the seller actually controls the domain at the registrar before any money moves. If they refuse escrow or cannot explain how they got the name, walk away.