On Monday morning there are three letters in the inbox. The first says your domain registration is expiring and has to be paid for today to keep it. The sender's name sounds official, but you do not remember ever signing anything with that firm. The second comes from a free mailbox: "We analysed your website and found 37 errors." The third arrived through your own website's contact form. Somebody writes that you are using their photo without permission, and the evidence is behind a link.
These letters look different, but they share a skeleton. This article goes through the mail almost every website owner gets: which of it is just noise, which costs money and which can cost you access. Then comes one rule that sorts all of it, and it applies to our own messages too.
Why this mail comes to you
Nobody read your site before writing to you. Usually your address was simply on a list. Your company name and registry code are in the business register, your email address is on the contact page, the contact form is public and the domain's details sit in a public registry. A machine gathers them up and sends the same letter to thousands.
Sending a letter costs the sender next to nothing. If even one recipient in a thousand pays, the work has paid for itself. That means the letter is not written for you on a calm day. It is written for your busiest day: the moment you go through your mail on a phone between two meetings and want the inbox empty.
The invoice you never ordered
The most expensive of these letters looks like an invoice. It has a logo, a reference number, a due date and your company's correct name. Two shapes are especially common.
A domain "renewal" from somebody who is not your registrar. The real renewal notice comes from the firm you rent the domain through and paid last year. The fake one comes from somebody else. The small print often says it is not an invoice at all but an offer to move the domain to them, or to sell you an extra service. If you pay, you have accepted the offer. Who the registrar is and who the registry is is explained in the article on the words in a quote. Here one question is enough: is this firm on last year's invoice?
An "update" of your details in a directory nobody reads. The letter asks you to check and confirm your company's details. The form is already filled in, because the details were taken from the public register. Signing or confirming means agreeing to an entry in some business directory, often for several years and for an annual fee printed in small type. The state's own register needs no signature on such a form and charges nothing for your company being in it: since October 2022 the business register's data has been free for anyone to see, and you change your own details yourself in the company registration portal.
Some of these letters are fraud, some are merely misleading sales. To you it makes no difference, because both live off the invoice being paid by somebody who does not know what the company actually ordered. That person is usually not the owner. It is the bookkeeper, who pays out anything that looks like an ordinary invoice.
The letter that gives you seven days
Another common letter comes from far away. A domain registration firm in Asia writes that somebody has applied to register your company name with a Chinese or Asian domain ending. They say they wanted to check first whether this is in line with your wishes, and they expect an answer within seven working days. If you reply, you are offered the chance to buy those names yourself before the "applicant" does.
There is no applicant. The letter is a sale dressed up as a warning, and the same text has been going round for years. If you do no business in Asia, you do not need a name there. If you do, you buy it through your own registrar, not from a firm that wrote to you out of nowhere.
The seven days are this letter's tool. The real deadlines around your website do not come as a surprise. The domain's expiry date is known a year ahead, and the notice comes from whoever you have a contract with. When a letter hands you a clock you knew nothing about, it is usually the sender's clock, not yours.
The same letter also arrives as a voice. The caller says they are from Google, and that your business listing will disappear from the map unless you verify it right now. Google's Business Profile is free, and the verification code is meant for you, not for the caller. If you want to know whether anything is wrong with the listing, sign in to your account yourself. How to take the listing into your own hands is written up separately.
The letter that promises first place on Google
"We found 37 errors on your website" is probably the most common of these letters. It comes from a free mailbox, names your site correctly and sometimes adds a screenshot. Behind it is a tool that walks through thousands of sites automatically, and the same letter goes to everyone on whose site the tool found something. It always finds something.
Google says it plainly on its search help pages: be wary of web firms that email you out of the blue. The same page has a second sentence: nobody can guarantee first place on Google. And Google adds that it gets these emails too.
The letter is not wrong merely because it is spam. Some of those 37 errors may be real. But the list shows what the tool is able to measure, not what costs you customers. A missing image description and a slow homepage are not errors of the same weight, yet in the letter they stand in one row. If you want to know why your site does not show up in Google, start with the real reasons, not with a stranger's list.
This letter's sibling asks for permission to write a "useful article" for your site, with a link to their client's site inside it. Sometimes money is offered for it. They do not want your readers, they want your domain's trust. Google's spam policies treat buying and selling links for ranking as spam, and a site that breaks the rules can drop in search. That includes the site that sold the link.
The letter that accuses you
The third letter is the most unpleasant, because it accuses you. A photographer or a designer writes that you are using their picture without permission. They are angry, they mention court, and they give you a link with the evidence behind it. The letter often comes through your own website's contact form.
That is exactly the trick. A contact form message comes from your own site, so it slips past the spam filter more easily and looks like an ordinary customer enquiry. In 2021 Microsoft's security team described precisely this kind of campaign: the messages came in through companies' contact forms, threatened legal action over copyright, and the "evidence" link led to a page built on Google Sites that asked the reader to sign in and then downloaded a ZIP file carrying malware.
Copyright claims also come for real, and if you use a picture you cannot account for, a real letter may arrive one day. The difference is simple. A real claim names the specific picture and the address of the page it is on. To check it you do not have to download anything, because the evidence about your site is on your site. Open your site yourself and look. If the picture is there and you do not know where it came from, read the article on images for what to do next.
The same accusation reaches the owner of a Facebook page too: the page broke the rules and will be shut down within 24 hours unless you appeal. The appeal link leads to a page that looks like Facebook and asks for your password and your verification code. Whoever gets those now owns the page. If something really is wrong with the page, you will see it when you open Facebook yourself, without clicking the link in the message. And it is a good moment to check who else has access to your page.
Three things they all have in common
These letters are about different things, but they are built the same way.
- A sender you have no contract with. Or one who pretends to be somebody you do. You cannot name them before you open the letter.
- A clock. Today, within 24 hours, within seven working days. A quick decision is a worse decision, and the sender knows it.
- A path the letter provides itself. Its link, its phone number, its form, its bank account. Everything you do, you do through its door.
Notice what is missing here. The logo, the legal wording and your company's correct name with its registry code prove nothing. All of them are public, and copying them costs nothing. The official look is the cheapest part of the whole letter. What is not public is your contract: who you pay, what number you usually call and where you usually sign in.
Answer by another road
That gives one rule that sorts every letter above: do not answer a letter through the letter itself.
If the letter says your domain is expiring, sign in to your registrar from wherever you signed in last year. If a caller says they are from your hosting company, end the call and ring the number in your contract. If somebody says their picture is on your site, open your site yourself. If Facebook warns you, open Facebook yourself. If the letter was real, you will find the same information there. If you do not, you have your answer.
Estonia's Information System Authority, RIA, advises the same: check a suspicious message through another channel, not the one it came through. You can forward a suspicious letter to CERT-EE, the national cyber security team, at cert@cert.ee.
If you have already clicked or typed something in, it happens to careful people too. Now speed is what counts. If you gave away a password, change it by your usual route, not through the link in the letter, and turn on two-step sign-in. If you gave card details, call your bank straight away. If you downloaded a file and opened it, tell whoever looks after your computers before you do anything else. The sooner, the cheaper.
We also get in touch sometimes without being asked
Here we have to be honest: this article is about us as well. WebAdmin checks the public websites of many Estonian companies, and when we see something that needs the owner's attention, we let them know, even when they are not our client. What we check and why is set out in the article on Chrome's danger warning.
So use the same rule on our message. If we say Google considers your site dangerous, do not take our word for it: ask Google itself, without our link. If we are right, you will see the same thing. If you do not, either things have changed since or we were wrong, and either way we want to know. A good letter survives a check that goes around it.
One list you can finish today
Write down who you expect invoices and notices from about your website and domain. There are usually four or five: the domain registrar, the hosting company, whoever built or maintains the site, the email provider, and the Google and Facebook accounts that send you notices. Next to each name, note where you usually sign in and what number you call.
Give that list to the person who pays the company's invoices. An invoice whose sender is not on the list stays unpaid until somebody has checked it, and the check goes through the numbers and sign-ins on the list, not through the invoice. It takes a couple of minutes, and it robs the letter of its strongest weapon: the deadline it made up itself.
If you cannot fill in the list because you do not know who your domain is registered through, that is the most important finding of all. Whose name your domain and accounts are really in is the next step from that question.
A letter from a sender who is not on the list is not yet a fraud. It is simply a letter you do not have to answer today.
Frequently asked questions
A genuine renewal notice comes from your registrar, the firm your domain is registered through and that you have paid before. Compare the sender with your previous domain invoice. Do not pay through a link in the letter: sign in to your registrar by your usual route and check the expiry date there. If the letter comes from a firm you have no contract with, it is usually an offer to move the domain to them or to sell an extra service, even when it is laid out like an invoice.
You do not need to do anything. The point of such a letter is to sell you domains you did not need, and the short deadline is there to make you decide quickly. The applicant the letter mentions usually does not exist. If you really do business in Asia and want a domain there, buy it through your current registrar, not from the firm that wrote to you.
Not always a scam, but almost always an automated mass mailing. Google writes on its search help pages that you should be wary of web firms that email you unexpectedly, and that nobody can guarantee first place. Some of the errors listed may be real, but a machine found them, and they are not ranked by what actually matters to your business.
Do not open the links or files the letter offers as evidence. A real claim says which picture and which page it is about, so you can check it by opening your site yourself. If the letter wants you to sign in or download a file to see the evidence, it is most likely a phishing message. If the picture really is on your site and you do not know where it came from, find out, and if needed remove it or get permission to use it.
Act at once, because every hour counts. If you typed in a password, change it by opening the service yourself rather than through the letter, and turn on two-step sign-in. If you gave card details, call your bank immediately. If you downloaded a file and opened it, tell whoever looks after your computers right away. You can forward the suspicious letter to CERT-EE, the national cyber security team, at cert@cert.ee.
Read next
A message filed as spam gives you no error, no notice and no bounce. The three settings that tell the receiving side a message is really yours, and the one contact form that sends your customers' mail under a stranger's name.