How to Spot Fake Domain Renewal Notices in Singapore

A lapsed domain can take a company's website and email offline together, which is why "your domain is about to expire" is such a reliable hook for scammers. Fake notices tend to arrive at busy moments, and they often reach someone who does not manage the domain day to day.

SGNIC, the registry for .sg domains, issued a scam alert and advisory on 21 September 2026 about emails that impersonate it. This guide explains who actually sends renewal notices, how to check a message in about five minutes, and what to set up so the next notice is easy to judge. It is educational guidance, not legal advice.

Who legitimately contacts you about a .sg domain

Three parties are involved in a typical .sg domain. Mixing them up is what makes a fake notice believable.

• SGNIC, the registry. Its advisory says it will never request payment from you for any domain name-related transactions.
• Your registrar or service provider. This is where you bought the domain. According to SGNIC, renewal notices come from this company, not from SGNIC.
• Your administrative contact. Under VerifiedID@SG, this person normally verifies the registrant's details with Singpass (individuals) or Corppass (organisations), and receives daily reminder emails while a domain is unverified. SGNIC issues an SGNICID only in limited exceptional cases.

The same advisory covers a second scam that has nothing to do with domain renewals: emails impersonating SGNIC about SMS Sender ID Registry fees. SGNIC says its emails will not contain a payment link, and that these fees are paid only through the official SSIR portal.

Six red flags in a renewal notice

No single flag proves a scam, and a polished message can still be fake. Use these to decide when to stop and verify.

• The sender is not your registrar. Check your billing records to see who you actually paid. A notice that names SGNIC as the party to pay does not match SGNIC's stated position.
• Payment is requested through a link or attachment. A genuine renewal can be completed by signing in to your own account, so you never need to click.
• The message creates urgency. Threats such as "cancelled today" should be tested against the expiry date in your registrar account.
• It asks for credentials or one-time passwords. Never share passwords or OTPs with anyone who contacts you, and enter login details only on sites you opened yourself.
• The details are wrong or generic. Look for a company name you do not recognise, a domain you do not own, or an extension you never registered.
• The link or reply address does not match the sender. Check where a link leads before touching it, but do not rely on appearance alone.

A five-minute check before anyone pays

1. Pause. Do not click, reply or call a number in the message. Forward it to your IT lead or whoever manages the domain.
2. Identify your registrar from your own records. Use the original invoice, your accounts team or your password manager, not the email.
3. Sign in by typing the address or using a saved bookmark. Z.com customers can reach the client area from the Z.com Singapore domain renewal page.
4. Compare the account with the email. Check the expiry date, auto-renew setting and administrative contact. A notice can arrive before an invoice is due, so an empty invoice list does not settle the question. Compare expiry, billing information and provider records, and resolve any mismatch through your registrar's official contact channel.
5. Check the domain's status on SGNIC. For a .sg domain, use the WHOIS search on the SGNIC website. SGNIC's FAQ says "VerifiedID@SG-OK" means verified and "VerifiedID@SG-Pending" means verification is still pending.
6. Ask if still unsure. Contact your registrar through its official website. SGNIC's advisory also lists SGNIC as a contact for clarification.

Real notice or fake? A quick comparison

Where VerifiedID@SG reminders and fake notices get confused

VerifiedID@SG is a real requirement, so a scammer who mentions it sounds credible. SGNIC's FAQ sets out the facts. The administrative contact normally has 21 calendar days from registration to verify a new .sg domain, with a one-time seven-day extension. A new domain that is not verified in time is suspended, so the website and email stop working. A domain that needs verification cannot be renewed until it is done. Verification takes place in the VerifiedID@SG portal at verifiedid.sgnic.sg.

The FAQ does not say who sends the reminder emails or whether they contain links. The safe habit is therefore to type the portal address yourself or navigate from the SGNIC website, never from a message. If you receive reminders but are not the administrative contact, the portal has a "Stop Daily Reminder Email" option.

If you have already clicked or paid

• Contact your bank or payment provider immediately if you sent money or shared bank or card details, so it can act to limit further loss. Do this first.
• File a police report. ScamShield's guidance lists filing a police report online or at a Neighbourhood Police Centre as a separate step, and 999 for urgent help. This is different from reporting a suspicious message through ScamShield, which does not replace a police report.
• Stop and keep evidence. Make no further payments, and save the email, links and screenshots to include in your report.
• Secure your accounts. If you entered credentials, change the registrar and mailbox passwords and turn on two-factor authentication where it is offered.
• Review the registrar account. Look for changed contacts, nameservers or transfer requests, and tell the registrar's support team.
• Report suspicious messages. Use the Report a Scam button on the ScamShield website, or call the ScamShield Helpline at 1799 if you are unsure about a message.

Set up your domain so the next notice is easy to judge

• Keep a one-line record. Note the domain, registrar, expiry date, administrative contact and who pays.
• Use contact details that someone monitors. Avoid a single employee's inbox. For .sg domains, the contact who verifies normally needs Singpass or Corppass (SGNICID exceptions are limited), and SGNIC's FAQ says a change of administrative contact triggers re-verification before renewal. Plan the handover before staff leave.
• Know what auto-renew does. On Z.com, auto-renewal is on by default after registration, and an invoice is generated before the expiry date. You can check it under My Domains in the client area.
• Know what expiry means. Rules differ by extension, so confirm the expiry and grace-period terms for your own domain on the domain renewal page before relying on any example. As a general Z.com example, an expired domain becomes inactive immediately, with a 30-day grace period at the regular rate before a redemption stage with an extra fee. Do not assume that the general 30-day example applies to your .sg domain; confirm the applicable terms with your registrar.
• Check WHOIS privacy. Z.com lists free WHOIS privacy with each registration, but not for some TLDs and ccTLDs, so confirm availability for your extension on the WHOIS privacy page. It reduces what is public, but it does not stop all scam emails.

Common mistakes to avoid

Frequently asked questions

Check your domain renewal settings

Review expiry dates and auto-renew in your Z.com account, and see how renewal and grace periods work.

Review Z.com domain renewal

Sources: SGNIC Scam Alert & Advisory (21 September 2026), SGNIC VerifiedID@SG FAQ, ScamShield: I have been scammed and ScamShield: check for scams.