I got an email saying I must "pay to renew my SEO/domain" — is it a scam?

You open your inbox and find an email with an alarming subject line: "Your domain expires in 48 hours" or "Invoice: SEO renewal — payment due now." It looks official — a logo, a bank account, a deadline. And your gut tells you something is off.

Your gut is right. In most cases these messages are a well-known scam called domain slamming: fake invoices blasted out to website owners, betting on fear and haste. The good news: they're easy to spot once you know what to look for. In this article I'll show you the exact warning signs, how to verify in two minutes whether it's real, and what to do if you've already paid.

How the scam works, briefly

Scammers buy or scrape lists of registered domains (registration data is often public) and send "invoices" that mimic a legitimate renewal. There are two classic variants:

• The "domain renewal" invoice — looks like it's from your registrar, but it's actually a completely unrelated company. If you pay, you either lose the money outright or you transfer your domain to them (the "slamming" part), which is hard and expensive to reverse.

• The "SEO renewal / search engine listing" invoice — sells you an invented service: "renew your Google ranking" or "annual directory listing." In reality there's no Google subscription to renew.

Both bet on the same thing: you don't know exactly where your domain lives or who manages it, so you pay on reflex.

The clear red flags

Look for these signs — usually several show up at once:

• Artificial urgency: "expires today," "last chance," "suspension in 24h."
• A company name you don't recognize and never bought anything from.
• Vague wording: "SEO renewal," "search engine listing," "annual indexing."
• A foreign bank account or a company registered in another country.
• Fine print at the bottom saying, in effect, "this is not a bill, it's an offer" — that's their legal escape hatch.
• You're asked to pay quickly by bank transfer, not through your usual account.
• The sender's email address doesn't match the company it claims to be.

If you tick two or three of the above, it's almost certainly a fraud attempt.

How to verify in two minutes

Don't click any button in the email. Instead:

1. Recall where you actually bought your domain — the company you log into when you pay each year (your registrar). If you don't know, ask whoever built your site.

2. Go directly to your registrar's site (type the address yourself, don't use the email link) and log in. There you'll see the real expiry date and whether anything is actually due.

3. Check your domain's public WHOIS (a simple "whois yourdomain" search) — it shows the real registrar and expiry date.

4. Compare the company name in the email with your real registrar. If they don't match, it's a scam.

A legitimate renewal always comes from the company you already pay, and it matches your domain exactly.

What to do — and what NOT to do

If the message is suspicious:

• Don't pay, and don't click links or attachments.
• Don't reply with any data (don't confirm the domain is yours, don't send card details).
• Mark it as spam/phishing and delete it.
• If you have a developer or agency, send them a screenshot before doing anything.

If you've already paid:

• Contact your bank immediately and ask them to block or reverse the transfer — the faster, the better.
• Check your registrar account to see whether the domain was actually transferred or changed.
• Change your registrar password and enable two-factor authentication.
• Keep the email as evidence; you can report it to authorities and to your real registrar.

Why you'll never get this from a serious agency

A real domain renewal is simple and predictable: you know the company, you know the amount, you pay once a year, no drama. "SEO" is not something you "renew" like a subscription that makes you vanish from Google if you forget — anyone telling you that is scaring you into buying.

At MPO Web Studio we work the opposite way: we tell you clearly where your domain is registered, what the real renewal costs, and who handles it. We work remotely across the country, with transparent pricing and no surprise invoices. If you got one of these emails and you're unsure, send us a screenshot on WhatsApp — we'll tell you in a few minutes whether it's real or a fraud attempt, no strings attached.