The Domain Renewal Hijack

Flggd Scam School · Delivery, Refund & Logistics Scams · Lesson 16 of 16

An email asks you to approve a domain transfer you never requested, or to sign in to "keep your website active." If you're searching about a domain transfer approval email, don't click anything yet.

The message looks like this

Why this is a scam

Real transfer requests only exist when a domain owner starts one. If you didn't, there is nothing pending, and nothing to approve or block.

The "confirm your credentials" page is a login clone for your registrar. With your username and password, a scammer can genuinely transfer your domain away, along with the website and email addresses attached to it. This is one of the few scams where the fake threat becomes real the moment you comply.

Small-business owners are the main target: losing a domain means losing the shop.

Red flags checklist

• A transfer or "approval" you never initiated.

• The email asks for your registrar login through its own link.

• The sender's domain matches no registrar you actually use.

• A 24-hour deadline threatens your website's uptime.

• Generic wording: your actual domain name is missing or wrong.

The manipulation tactic

Fear of loss. A website going dark threatens your income and identity, so "confirm now" beats "check first" unless you know the trick.

What to do, and what not to do

• Don't click approve, cancel, or sign in from the email.

• Log in to your registrar directly, typed in by you, and check for real pending transfers.

• Turn on transfer lock and two-factor authentication in your registrar settings.

• If credentials were entered, change the password immediately and alert your registrar.

• Report the email as phishing.

Not sure about a message you've received? Check it in seconds with the free Flggd app.