Why scammers love this trick
Most of us only think about hosting and domain names when something goes wrong, so a message about it gets our attention fast. Criminals know this. They copy the look of a real company, add a deadline, and hope you click before you think. If you hand over your login, they can take over your website, your email, or both. At this time of year, with renewals and invoices flying about, these emails get even more common.
Step 1: Look at who really sent it
The name next to the email can say anything, such as “Your Hosting Team”. What matters is the address behind it. Tap or hover over the sender name and read the full address. If it ends in something odd, like a string of random letters, or a close-but-wrong spelling of your host’s name, treat it as fake. Be careful of free addresses too, such as Gmail or Outlook, because a real hosting company will not email you about your account from one.
Step 2: Check the tone and the demands
Real companies do send renewal reminders, but they rarely threaten you. Watch for these warning signs: you must act within 24 hours, your site will be deleted today, you are told to pay by gift card or bank transfer to a new account, or the email does not use your name or your company name. A genuine message from your host will usually mention something specific, like your actual domain name or a plan you recognise. “Dear customer” on its own is a red flag.
Step 3: Never click straight from the email
This is the golden rule. Even if the email looks perfect, do not use the buttons or links in it. Instead, open a new browser tab, type in your host’s website yourself, and log in the way you normally do. If there really is a problem with your account, it will be shown there. If nothing is shown, the email was almost certainly fake. You can also look up your host’s phone number from their official website and ring them to check.
Step 4: Beware of unexpected attachments and invoices
A fake “invoice” or “account statement” attached to an email is another favourite. Unless you were expecting a bill from that company, do not open the attachment. Files like these can quietly install nasty software on your computer.
What if you already clicked?
Do not panic, as this happens to careful people too. Work through these steps quickly. First, if you typed in a password, change it straight away on the real site, and anywhere else you use the same one. Second, switch on two-step login (a code sent to your phone) if your host offers it. Third, tell whoever looks after your website so they can check nothing has been changed. Finally, report it. In the UK you can forward suspicious emails to [email protected], a free service run by the National Cyber Security Centre, and you can report fraud or lost money to Action Fraud.
Your quick takeaway
Pause, check the sender, ignore the links, and go to your host the way you normally would. Fake emails rely on you rushing, so a 60-second pause is your best protection. It also helps to know who your host is in the first place: a surprising number of small businesses are not sure whether their host is the company that sends their invoices or somebody else entirely. Having one clear, trusted contact makes a fake email much easier to spot.
Not sure whether an email from your host is genuine, or who actually looks after your hosting? Our Managed Hosting service means you have one friendly point of contact who knows your setup, so you can simply ask us before you click.
