Academy › Publishing › Domain and email
Verify in the panel, never through the link in the email
You'll recognize the fake expiration or transfer notice for your domain and email, and you'll check it by logging into your registrar yourself, never through the link.
By Yodai · Published September 6, 2026 · Updated October 13, 2026
The transfer lock keeps anyone from moving your domain to another registrar without your sign-off. There's one way around it without touching it directly: convince you to remove it yourself. You get an email today saying your domain expires in twenty-four hours, or that someone has requested a transfer out and you need to click to cancel it. The logo matches your registrar, the subject line has your domain written right in it, and the button says "Resolve now." You feel the urgency, and you're one click away from typing in your password.
That click is the exact moment a domain gets lost. Not a weak password, not a recovery email set up wrong: the click. Everything you've locked down in this course, the password you never reuse, the recovery email outside your own domain, the authenticator app instead of a text message, the lock that keeps your domain from being moved without your signature, none of it matters if you type that password into an exact copy of your registrar's dashboard.
How to spot a fake email
The fake email shares a trait with a lot of scams: the deadline is short. A real registrar doesn't send its first warning with only a day's notice. For generic domains like .com, ICANN's policy for recovering expired domains requires the registrar to notify you at least twice before it expires: once roughly a month ahead, and again roughly a week ahead. The policy lets the registrar send more notices than that, but if the first one you've ever seen boxes you into twenty-four hours, it's already suspicious before you read another word.
The second trait is that it asks you to approve or unlock something you never requested. That's where the transfer lock comes in: according to ICANN's guide to domain status codes, with that lock in place the registry rejects any request to move the domain to another registrar, and to transfer it you first have to ask your own registrar to remove the lock. An email claiming your domain "has been unlocked" and asking you to approve a transfer, when you haven't touched anything, is false by definition. No one can unlock it without going through you first.
Where they get your domain and exact date
What's unsettling is that the email gets the date right. That's not magic: a domain's expiration date is public information. For generic domains like .com, ICANN's registration data policy requires publishing the registrar, the registration date, and the expiration date. You can look it up with a WHOIS or RDAP tool just by typing in the domain name, no need to log into any panel.
Whoever sends these emails doesn't need to be watching you at all. All they have to do is pull that public data to put your domain, your registrar, and the date into the email. That's why they get the exact detail right, and there's nothing strange about them knowing it. Anyone who types your domain into the right search box can find it.
Why the link is the trap
The link in the email doesn't lead to your registrar's dashboard. It leads to a page that's an exact copy: same logo, same form, even the same footer with the legal notice copied word for word. The only difference is the address in the browser bar, and that's the one thing nobody checks when they're in a hurry.
From there, all they need is whatever you type in: your password and, if the page asks for it, your two-factor code. The moment you type it, whoever built the fake page uses it to log into the real panel, removes the lock if they can, and moves the domain before you even realize the email was fake.
The page behind the link isn't your registrar's dashboard: it's a copy that exists only to capture what you type
The rule that never fails
The rule is simple and has no exceptions: no notice about your domain gets handled from the link in an email. Handle it by opening a new tab, typing the registrar's address yourself, or using the bookmark you already have saved, and logging in the way you always do. If there's something real to resolve, it'll show up inside the account. If nothing shows up, the email was fake and the matter's closed. Gmail's help center gives the same advice: if you click a link and it asks for your password, don't type it in, go straight to the website you meant to visit instead.
This holds true even if the notice comes by text message or a call claiming to be the registrar's tech support. The channel changes. The rule doesn't: you act from within the dashboard, never by following the path laid out in a message that showed up out of nowhere.
You never need to give anyone your two-factor code either, not over the phone, not by email, not in chat. Google's help center on two-step verification says it plainly: don't share your verification codes with anyone, because scammers can use them to try to take over your account, and Google will never call you to verify a code. If someone asks for it to "verify your identity," you already know it's not support.
- 1Don't touch the link
Not to read it, not to cancel anything. The cancel button leads to the fake page too. - 2Open a new tab
Don't use your browser history or copy the address from the email: type it yourself, or use your saved bookmark. - 3Log in the way you always do
Username, password, and the second step from your app, just like any other day. - 4Check the domain's actual status
Renewal date, transfer lock, pending requests: all of that lives inside your account, not in an email. - 5If nothing's pending, delete the email
Report it as phishing if you want to, but there's no need to reply or alert anyone else.
The same scam targets your email too
The same setup works just as well on your email account, not just your domain. You get a notice that your inbox is full, or that there's suspicious activity, with a link to "verify your account." It's the same trap in a different costume.
Verifying it is just as simple: log into your email from the address you always use, gmail.com, or the admin console if you manage multiple accounts on one domain, and never from the link in the notice. If there really were unusual activity, you'd see it yourself inside the account: for a security notice that looks like it's from Google and makes you second-guess yourself, Gmail's help center points you straight to myaccount.google.com/notifications, where you'll find recent activity related to your account's security. No one needs to flag it for you with an urgent button.
With this, you've got the scam fully covered: you know what to look for and where to verify it. If the click has already happened and you typed your password somewhere you shouldn't have, the next lesson covers what to do in the following two hours.
- No notice about your domain or email is handled through the link that arrives in the message
- You always verify by logging into the dashboard on your own, typing the address yourself or using your bookmark
- A deadline measured in hours and an action you never asked for are enough reason to distrust the notice
- Canceling from the email is just as risky as approving it: the button leads to the same fake site
- No real support team asks for your two-factor app code by phone, email, or chat
Test yourself
Answer before opening each one. If one gives you trouble, go back to the section that explains it.
1. You get an email with your registrar's exact logo saying the domain will be transferred today unless you cancel through the link. You've had the transfer lock on since the last lesson. What do you decide?
You ignore the link: with the lock on, no transfer can start unless you remove it yourself from the dashboard first, so the notice is fake by design. You go to the dashboard by typing the address yourself to confirm the lock is still active.
2. You get a text, not an email, warning that your domain expires tomorrow, with a link to pay the renewal. Does it change anything that it came by text instead of email?
Nothing changes: the channel is different, but the rule is the same. You don't pay or renew from the text link; you log into the registrar's dashboard on your own, and if there's really a renewal due, you pay it from there.
3. The email says your Gmail inbox is almost full and you need to verify it today or you'll lose messages; the link leads to a page asking for your Google password. What do you do before typing anything?
Close that page and log into Gmail from gmail.com, typed in yourself. If the notice were real, you'd be able to confirm it inside your own account. And Gmail's help center makes it clear: if you're already logged in, Google will never send you an email asking for that account's password.
With that, you can tell a real notice from a lure. But strong defenses and a trained eye aren't always enough: you also need to know what to do the moment one of these has already gotten through.
Sources
- Expired Registration Recovery Policy. ICANN, updated February 21, 2024, and mandatory since August 21, 2025 (accessed October 2026).
- EPP Status Codes | What Do They Mean, and Why Should I Know?. ICANN, accessed October 2026.
- Registration Data Policy. ICANN, revised May 2026.
- Avoid and report phishing emails. Gmail Help, Google, accessed October 2026.
- Turn on 2-Step Verification. Google Account Help, Google, accessed October 2026.
In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.
NextThe first two hours after it's already happened