Website Renewal Scam Emails and How to Report Them

An email says your website needs an urgent renewal, maintenance payment, or account update. The sender uses your website provider's name, and the request sounds like something a business owner might reasonably need to handle.

Before you pay, pause and verify it through a contact you already trust.

Someone recently impersonated our business in emails asking for website-related payments. That experience is why I'm sharing this guide. You should not have to guess whether a payment request is real, and you should know where to report it when it isn't.

Already sent money? Contact your bank or payment provider immediately. Do that before spending time assembling a perfect complaint.

What a website provider impersonation scam looks like

A suspicious message might claim that hosting is expiring, maintenance fees are overdue, or your website will stop working unless you pay quickly. It may use a familiar business name while directing payment somewhere unfamiliar.

Watch for a changed payment method, unexpected fee, unusual sender address, or pressure to act before you can check. A free email address can be a clue when it does not match your established relationship, but it is not proof of fraud by itself. Familiar branding and a professional-looking invoice are not proof of authenticity either.

The FBI describes related business email scams involving lookalike addresses, stolen credentials, and malicious software. Receiving an impersonation email alone does not establish that your website or your provider's account was hacked. Those are different possibilities that require different evidence. FBI guidance on business email compromise.

1 Verify the request outside the email

Do not reply to the suspicious message, use its phone number, or follow its payment link to ask whether it is legitimate. Do not open unexpected attachments. You could be asking the impersonator to vouch for themselves.

Instead, call your provider using a saved number, start a new message to a previously verified address, or visit the official website independently. Ask whether the invoice, amount, service, and payment destination are correct. Compare the request with your existing agreement and normal billing process.

If a message claims to be from us, contact us through contact details you already trust or our official website. There is nothing awkward about checking a payment request. The FTC recommends using contact information you know is real rather than information supplied in a suspicious message. FTC phishing guidance.

2 Save the evidence before clearing your inbox

Keep the original email and, if available, its full headers. Headers contain technical delivery information that may help distinguish what the message claims from how it was sent.

Create a secure folder for screenshots, the invoice, payment instructions, transaction receipts, and a brief timeline. Record when the email arrived, what it requested, whether you replied, and what happened next. Save suspicious links as text without visiting them. Ask your IT support person for help preserving the original message if needed.

Keep original files intact. Screenshots are useful, but they should not be your only record. IC3 recommends retaining electronic emails and related financial records securely. IC3 evidence guidance.

3 Respond based on what you actually shared

If you paid or shared financial information: Contact the bank, card issuer, payment app, or transfer service immediately through its official support channel. Describe what happened and ask how to protect the account. If money was sent, ask whether the payment can be stopped, reversed, recalled, or refunded. Keep the case number. Recovery is not guaranteed, but prompt reporting matters.

If you entered a password: Go directly to the real service, change the exposed password, change it anywhere else you reused it, and enable multifactor authentication. If you cannot sign in, use the service's official account recovery process.

If you downloaded something or gave remote access: Contact trusted IT support. Follow the FTC's guidance to update security software and scan for harmful software. FTC steps after a scam.

Simply receiving a suspicious email is not, by itself, a reason to conclude that every password is compromised. Match the response to what happened.

4 File a complaint through the official channels

You do not need to identify the person behind the email before reporting it. Describe the facts you know and label anything uncertain. Here are the main reporting options for this situation.

FBI Internet Crime Complaint Center

Use the official IC3 complaint form to report internet-enabled fraud, including attempted fraud without a financial loss. Identify the impersonated business, sender address, requested payment, relevant dates, and any actual transaction details.

IC3 does not accept attachments. Enter relevant details in the form and keep your original evidence. After submitting, save or print the complaint and confirmation before leaving the page. IC3 does not email you a copy. Reports may be referred to other agencies; a report does not guarantee an investigation or repayment. IC3 filing instructions and FAQ.

Colorado Attorney General

For a Colorado-related complaint, start at the Colorado Attorney General's complaint page and select the scams, telephone calls, text messages, and emails category. Stop Fraud Colorado also links to this official complaint route.

Read the disclosures before submitting. The complaint form says information may be shared with others, including the named business or its agents. Colorado's privacy policy also explains that submitted information becomes a public record and may be disclosed unless protected by law. Include relevant facts, not unnecessary sensitive information. Complaint form disclosures and Colorado privacy policy.

The Attorney General uses complaints to identify patterns and protect the public. It does not serve as your personal lawyer or promise to resolve your individual case.

Federal Trade Commission

You can also report the scam through ReportFraud.ftc.gov. The FTC uses reports to identify trends and build cases. This is a reporting channel, not a substitute for contacting your payment provider when money has been sent. FTC reporting guidance.

If the situation is time-sensitive, contact local law enforcement directly rather than waiting for a response to an online report.

5 Tell the real provider and flag the message

Let the impersonated business know through a verified channel so it can assess what happened and warn others appropriately. If you received the request or lost money, consider filing your own report with your firsthand details, even if the business has already reported the campaign.

After preserving evidence, use your email service's phishing-reporting option. In Gmail on a computer, open the message, select More next to Reply, and choose Report phishing. Google's reporting instructions.

Make verification part of normal business

Keep your website provider's verified contact details and billing information somewhere your team can find them. Agree on who approves unexpected charges and how changes to payment instructions are checked. Give staff permission to pause a request without feeling they are holding things up.

If you already responded, focus on the next useful step. These messages are designed to borrow trust from a real relationship. Checking, preserving evidence, and reporting the attempt can help protect your business and give authorities useful information.

Source links and reporting instructions checked October 27, 2026.