In short and in plain language
Fraudsters send fake emails about your domain. The domain is your address on the web. The email says your domain will soon be blocked. Often you are asked to type in a password.
Real emails about a check come first from your provider. That is the firm that bills you for the domain. DENIC only writes later. It runs all web addresses that end in .de. It does not ask for a password.
There are also fake bills for domains. They come as a file attached to an email. Often the address of the sender is missing. In small print it says: this is only an offer. Only pay firms you have a contract with.
Have you already paid? Then call your bank right away. Did you type in a password? Then change it at once in your account with the provider.
Decide who in your business reads emails about the domain. And who pays the bills for it. We are happy to help you with this.
An email with the subject line “Your domain will be blocked”, and attached to it an invoice for a domain registration nobody in the business ordered: messages like these can reach any business with its own domain, in the Hildesheim area and everywhere else. DENIC eG, the registry for .de domains, has been warning since 6 August 2026 (DENIC) about fake verification emails that request holder data in its name or in the name of a provider and threaten to block the domain. At the same time, the German association against white-collar crime reports another wave of fake invoices for domain registrations (DSW). The tricky part: genuine verification emails and genuine domain invoices exist as well. Since NIS-2, registries have to check the details of domain holders, and anyone who uses a domain pays someone for it. This article shows how to tell a genuine request from a fake, who actually bills you for a domain, what to do in the first hours after a payment or a click, and how a fixed routine in the business keeps it from getting that far.
Key takeaways
- Fake verification emails threaten to block the domain “in 24 hours”, which DENIC calls a classic phishing pattern (DENIC). Genuine DENIC emails come from addresses under denic.de and do not ask for passwords, payment or login details by email.
- A genuine .de verification starts with your own provider. DENIC only sends a reminder around 24 days later and then sets a 5-day deadline (DENIC); once the domain is offline, there are 83 days (DENIC) left to complete the check.
- Fake domain invoices arrive as email attachments without the sender's address, and the small print says “offer”. In the wave reported on 17 February 2026 (DSW), the amounts averaged 250 euros (DSW).
- A domain is normally billed by the company you ordered it from. DENIC only issues invoices itself when a domain is under direct management through DENICdirect, and then may send them by email (Section 4(3) DENIC Domain Terms and Conditions).
- After a payment, contact your bank immediately (IHK Frankfurt am Main): once received by the bank, a payment order can no longer be revoked (Section 675p(1) German Civil Code), so the bank can only attempt a recall.
- Since 9 October 2025 (Regulation (EU) 2024/886), banks in the euro area match IBAN and payee name before a transfer. A mismatch warning is a reason to stop; a match does not prove the claim is real.
Two scams, one lever: time pressure
DENIC describes the fake verification emails like this: they claim to act on behalf of DENIC or a registrar and ask for holder data to be confirmed or updated, often adding that the domain will otherwise be blocked or deleted (DENIC). The emails reported to DENIC came neither from DENIC nor from a registrar. As a typical pattern, DENIC names phrases such as “your domain will be blocked in 24 hours” (DENIC) or “immediate action required”, and points out that genuine verification processes run with reasonable deadlines.
There is a real reason why the scam works right now. Since NIS-2 was transposed, the German BSI Act has required registries to keep accurate and complete registration data and to maintain procedures, including verification procedures, for that purpose. They had to make these procedures publicly available by 6 March 2026 (Section 49(3) BSIG). Since then, DENIC has been checking not only newly registered domains but also existing ones that have run for many years without complaint (DENIC). An email that sounds like verification therefore seems plausible, which is exactly what the senders of the fakes rely on. With more than 18 million registered .de domains (DENIC), the pool of potential recipients is large.
The second scam is older and targets the accounts department. On 17 February 2026 (DSW), the association reported another wave of fake invoices for domain registrations, and IHK Frankfurt am Main passed the warning on to businesses (IHK Frankfurt am Main). The letters arrive as email attachments, the sender's address is missing entirely, and the amounts average 250 euros (DSW). Both scams pull the same lever: they attach time pressure to a routine task so that checking back seems unnecessary. Knowing the genuine procedure takes that lever away.
How a genuine verification of .de domains works
DENIC checks the stored holder data automatically for completeness and plausibility and compares addresses with external sources (DENIC). If something stands out, it does not contact the holder first, but the DENIC member that manages the domain, in other words the provider. The provider then contacts the holder and explains which procedure is needed: a confirmation by email, a code, an address confirmation by post or proof of identity with an ID document (DENIC). According to DENIC, the verification itself runs exclusively through the provider, and it costs nothing (DENIC).
Only if that has not worked does DENIC write itself. In the vast majority of cases, the provider will already have requested verification about 24 days (DENIC) earlier; the DENIC email is an additional reminder shortly before the deadline. From the moment it arrives, there are 5 days (DENIC) left. According to DENIC, the binding deadline is the specific date stated in the email. After that, DENIC removes the domain from the .de zone, and the website and email addresses stop working. The domain is not deleted yet, though: from the day it goes offline there are 83 days (DENIC) to complete the verification through the provider; only then is the domain contract terminated. The overview below is taken from the graphic DENIC attached to its warning in August 2026 (DENIC).
| Point in time according to DENIC | Who writes | What is requested |
|---|---|---|
| Day 0 | Your provider | Prove holder data; the provider names the procedure |
| Day 24 | DENIC, from addresses under denic.de | Reminder: complete verification with the provider within 5 days |
| Day 30 | DENIC | Domain offline, reactivation through the provider still possible |
| Day 113 | DENIC | Termination of the domain contract, the domain is released |
Three features of the genuine sequence work as a test. First, the initial request comes from the provider, and you know the provider because it bills you for the domain. Second, a payment request in connection with verification is a warning sign, because the check itself is free. Third, by its own account DENIC does not ask for passwords, payment details or login data by email, and its emails carry the sender domain denic.de (DENIC). One qualification matters: genuine provider emails may also contain a confirmation link or a code (DENIC). A link alone is therefore no proof of a fake; what counts is where it leads and what it asks for.
For extensions such as .com or .net, ICANN's rules apply rather than DENIC's. Genuine verification emails are routine there as well: holders must respond to inquiries from their registrar within 15 days (ICANN) and keep their account data current. Here too, the sender is the registrar or the company through which the domain was ordered, not an organisation unknown to you. How to clarify ownership, provider and access once and for all is explained in our article Who owns your website?.
Four warning signs of a fake verification email
The features from the DENIC warning can be checked in any inbox without tools. None of them requires specialist knowledge, but each requires you to pause briefly instead of clicking the first button. In the mockup above they are marked with the numbers one to four.
Sender domain
What matters is the domain after the @, not the display name. DENIC emails come from addresses under denic.de, your provider's emails from its known domain. Additions such as “-verify” or an unfamiliar extension are a reason to stop reading. The BSI advises moving the mouse pointer over the sender line without clicking to reveal the embedded address (BSI).
Threats measured in hours
“Blocked in 24 hours” is a classic phishing pattern according to DENIC (DENIC). A genuine DENIC reminder states a date several days ahead, and as a rule the provider will have been in touch beforehand. If the first you hear of an alleged block is the email itself, ask your provider first.
Link with a different target
Hover over the link without clicking and read the actual target address (DENIC). If it differs from the visible text or leads to an unfamiliar domain, the email belongs in the bin. According to the BSI, “https://” is no longer an all-clear either, because fraudsters buy certificates too (BSI).
Password or payment field
DENIC asks for neither passwords nor payment or login details by email, and the verification itself costs nothing (DENIC). A form that asks for exactly that is the fake. Login details belong only in the customer account that you open yourself via a known address.
Do not rely on spelling mistakes. According to the BSI, typos or odd umlauts are now only rarely a clear sign of a phishing attempt (BSI). In Bitkom's current business protection survey, 38 percent (Bitkom) of the companies that see or suspect increased use of artificial intelligence by attackers point, among other things, to the high quality of text messages and emails as evidence. Bitkom lists phishing at 16 percent (Bitkom) and spoofing, that is faking someone else's sender identity, at 11 percent (Bitkom) among the widespread attack types that cause damage to companies. The survey covered 1,003 companies (Bitkom) in Germany with at least ten employees and annual turnover of at least one million euros. A friendly, well-written email is therefore no evidence of being genuine.
Check back without the link in the email
Invoices that are really offers
Fake domain invoices are not technical attacks but letters aimed at an established routine. Domains are paid for regularly, the amounts are modest, and in many businesses the accounts team does not know which company the domain runs through. The association describes the current letters as attachments to emails of unclear origin; essential basic details such as the address are missing entirely (DSW). Even in earlier mailings, only the small print revealed that the supposed invoice was merely an offer (DSW). Anyone who pays is, at best, paying for a service they do not need, and at worst paying strangers.
The accounts change from wave to wave. For the letters of February 2026, the payment accounts point to Belgium (DSW); in the notice of 27 August 2025 (DSW), the recipient accounts were held in Germany, Spain and Portugal. A German IBAN is therefore no proof of authenticity. Even so, it is worth a look: a German IBAN has 22 characters (Deutsche Bundesbank), and the first two characters (Deutsche Bundesbank) of every IBAN name the country in which the account is held. If your domain is with a German provider and you receive an invoice with a foreign account, you have a concrete reason to check back.
A second check is a formal one. For invoices from German businesses, VAT law requires, among other things, the full name and full address of the supplier (Section 14(4) UStG), even for small-amount invoices up to 250 euros (Section 33 UStDV). A letter that lacks precisely these details is not a sound basis for a payment for that reason alone. For the accounts team, the practical rule is simpler than any legal question anyway: domain invoices are only paid if the sender is known as a contract partner.
- Is the sender the company the domain was actually ordered from, according to the contract, the customer account or previous invoices?
- Does the letter quote a customer or contract number that matches your records?
- Does it state the sender's full name and address, plus a tax number or VAT identification number?
- Does the country code of the IBAN match the location of the company you have a contract with?
- Does the word “offer”, “quotation” or “listing” appear anywhere, including the small print or a second page?
Who actually bills you for a domain
With .de domains there are three parties: the holder, DENIC as the registry, and the provider that manages the domain on the holder's behalf. According to DENIC, your direct contract partner is usually the company that invoices you for the domain (DENIC). Often that is a hosting company or an agency which is itself a customer of a DENIC member. The domain lookup then shows not your contract partner but the member at the end of this chain (DENIC). An unfamiliar company name in a genuine DENIC email is therefore not yet a sign of a fake, but it is a reason to ask your own provider.
As long as a DENIC member manages the domain, your obligation to pay DENIC is suspended. This is precisely the case in which a genuine payment request from DENIC arrives: if the provider gives up managing the domain, the payment obligation revives and the holder pays future domain fees directly to DENIC (Section 4(2) DENIC Domain Terms and Conditions). DENIC may then also send its invoices by email (Section 4(3) DENIC Domain Terms and Conditions). A DENIC invoice is therefore not fake by default. It can be genuine if the domain is under direct management through DENICdirect, and it is suspicious if a provider manages the domain.
If the provider drops out, DENIC first informs the holder by letter about the TRANSIT status, including a personal password for the TRANSIT Service Center (DENIC). The holder has one month (DENIC) to decide whether to move the domain to a new provider or have it deleted; both are free of charge at DENIC, whereas management by DENICdirect is subject to a fee (DENIC). Anyone receiving such a letter should take the deadline seriously and plan the move rather than leave the domain under direct management for good. How to switch without downtime for the website and mailbox is shown in our article Moving your domain and email.
Rule of thumb for the accounts team
Already paid or clicked: the first hours
If a fake invoice has already been paid, speed matters. The DSW advises those affected to involve their own bank as quickly as possible in order to reverse the transfer; contacting the recipient bank to reclaim the money can also help (IHK Frankfurt am Main). There is no simple revocation, however: once received by the bank, a payment order can no longer be revoked (Section 675p(1) German Civil Code). The bank can only try to retrieve the money, which is more likely to work while it is still in the recipient's account. With an instant transfer, the amount is available to the recipient within ten seconds (Regulation (EU) 2024/886), so hours of waiting cost chances.
- Call your bank immediately rather than reporting by email or contact form. Have the date, amount, recipient IBAN and payment reference ready.
- Ask the bank to initiate a recall via the recipient bank, and have the request confirmed with a date.
- Secure the invoice, the email including its headers and the bank statement, and report the case to the police; in Lower Saxony this can also be done via the online police station.
- Inform the accounts team and everyone who approves invoices about the pattern, so that a second invoice of the same kind does not slip through.
If someone clicked a link and entered login details, the problem is a different one. It then concerns the customer account with the provider, which controls the domain, DNS records and mailboxes. With these details, emails can be redirected, records changed or a provider transfer initiated. No bank can help here, only quick action in your own account and with the provider.
- Change the password in the customer account, via the known address and not via the link in the email, and change it everywhere the same password was used.
- Enable login with a second factor if the provider offers it.
- Check in the customer account whether name servers, MX records, forwardings or contact details were changed and whether a password for a provider transfer was requested.
- Inform the provider and document the incident. If someone gained access to the website, the steps in our article Website hacked will help.
What the bank's verification of payee does
Since 9 October 2025 (Regulation (EU) 2024/886), banks in the euro area have had to offer a check before every credit transfer: they verify whether the IBAN entered and the payee's name match before the order is released. If they do not match, the payer receives a notice that the money could go to an account whose holder is not the payee stated. The service is free of charge for the bank's customers.
For fake domain invoices, this is help with limits. If the invoice shows a company name but the account belongs to someone else, the bank displays a warning, and that warning is a clear reason not to pay. If the sender gives the correct account holder, however, the check matches even though the claim is invented. The check also does not prevent the payer from authorising the transfer despite a warning (Regulation (EU) 2024/886). And businesses that submit several payment orders as a bundle can opt out of the check (Regulation (EU) 2024/886). Precisely where small invoices are paid in batches, it is then missing. Verification of payee therefore does not replace the question of whether the contract exists at all.
A fixed routine in the business
Clear organisation within the business helps against both scams. In many businesses, domain mail goes to the person who commissioned the website years ago, or to a mailbox hardly anyone reads. Genuine requests get lost there; DENIC names the spam folder and outdated email addresses as common reasons why holders did not see their provider's email (DENIC). Fakes, on the other hand, often reach the person who pays invoices. Both can be sorted out with a few decisions.
A fixed routine answers three questions in advance: who receives emails about domains and hosting, who may approve domain invoices, and where is it recorded which domain is with which provider? Cover arrangements matter too. A deadline of 5 days (DENIC) can expire entirely during company holidays. If you close over the festive season, besides the special hours in your Google profile you should also settle who keeps an eye on the mailbox for domain mail during that time.
- Domain inventory: all of the business's domains with provider, contract partner, customer number and billing cycle in one list known to accounts and management.
- Contact address: store a role address such as domains@ with the provider and DENIC that several people read, rather than a personal mailbox.
- Approval rule: only pay domain and hosting invoices from companies on this list; everything else goes to the responsible person before payment.
- Check-back route: do not reply to suspicious emails, but ask via the provider's known phone number or the customer account.
- Reporting route: forward suspicious verification emails to the provider or mark them as phishing in the mail program, as DENIC recommends (DENIC).
A side effect of this order concerns your own domain. Securing it with SPF, DKIM and DMARC makes it harder for third parties to send emails to customers in your name, such as fake invoices bearing your company name. What these records do and how they are set up is explained in our article Professional email with your own domain. Many businesses already know the same pattern of time pressure and verification promises from the Google Business Profile, as our article on protection against fake profiles shows.
A genuine verification email survives a call to your own provider. A fake usually does not.
Domains and hosting with a fixed contact
If we look after both website and hosting, domain, hosting and mailboxes run through one contract partner the accounts team knows. If the domain is with us, we are the company through which verification runs, and the fixed contact you call about a suspicious email before anyone clicks or pays. How we set up hosting, domains, DNS and email is shown on our web hosting and domains page. Ongoing updates, backups and checks are described on the website maintenance page, and anyone who wants website, care and hosting bundled will find it in the website subscription.
To begin with, a conversation in which we draw up the domain inventory together is often enough: which domains exist, where they are held, who bills them and which address receives verification emails. An overview of all services is on our services page, and you can arrange an appointment via our contact form. After that, the next time an email about your domain arrives you will know whether it fits your contract, and with the next invoice whether it needs to be paid.
Related Articles
Set Up a Professional Email With Your Own Domain
Why info@yourbusiness.invalid beats free webmail: a professional image, deliverability and protection against spoofing with SPF, DKIM and DMARC.
Business Name and Domain: Check Trademarks First
A business name can be covered at once by a registered mark, a company sign, a personal name right and a registered firm. How to check before you commit.
Web Hosting 2026: What Local Businesses Must Check
Server location, backups, availability and PHP support: how to recognise dependable web hosting - and the eight questions to put to your current provider.