Domain Sale Scams: How to Spot Fake Buyers, Appraisal Scams, and Fake Escrow

Why would a buyer ask me to pay for an appraisal?

Because the appraisal is the scam. In the domain appraisal scam, a fake buyer offers a high price, says they will pay the “appraised value,” and asks you to get an appraisal from a service they trust. That service belongs to the scammer. You pay, and the buyer vanishes.

Namecheap’s write-up of the scam, by a domain industry journalist, describes the pattern in two emails.

1. Email one says a client is interested in your domain. The client is described as a rich investor with years of experience.
2. Email two, after you reply, names a price range. It often says the buyer will “pay the appraised value.” It asks whether you have an appraisal certificate and says you can order one online from a source the buyer trusts.

Namecheap’s key point is that the person emailing you owns the appraisal service. You will likely pay $50 or more. After you send the certificate, you will never hear from the buyer again. Namecheap also reports that scammers sometimes spoof the email addresses of well-known registrars to make the message look real.

The rule is simple. A real buyer makes an offer. A real buyer does not need you to pay for anything first. If someone asks you for an appraisal, Namecheap’s advice is to tell them to order it and pay for it. If they refuse, treat it as a scam.

If you want a real view of your domain’s value, see our guide to domain name valuation and the glossary entry on domain appraisal. A free tool is fine for a rough idea, but a price you can sell at depends on the buyer pool, not on a certificate.

What are the most common domain sale scams?

Most domain scams fall into six groups. They differ in the story, but they share one move: they get you to pay, send, or hand over something before you are paid.

Escrow.com, the FTC, and the Minnesota Attorney General describe many of these patterns. We cover each below.

How do I spot a fake escrow website?

The strongest warning sign is that the other party insists on a specific escrow site. Fake escrow is when a fraudulent organization poses as a legitimate company to take your money or your domain. Escrow.com notes that the person recommending a fraudulent escrow site is usually part of the scam.

Here is how the fraud works, in Escrow.com’s own steps for sellers.

1. A buyer recommends a fraudulent escrow site, often saying they would only feel comfortable using an escrow service.
2. The fake site tells the seller, by email or a status page, that the money has arrived.
3. The seller believes the money is safe and transfers the domain.
4. The buyer takes the domain. The seller never receives money.

Use this checklist before you register on any escrow site.

The Minnesota Attorney General’s guide adds two habits worth copying. Hover over any link and check the real destination before you click. Contact a company using the phone number and email on its official site, not the ones in a suspicious message.

For how real escrow works, including fees and timing, read how domain escrow works. If you want the short definition, see escrow and Escrow.com in the glossary.

How does the fake check or overpayment scam work?

In an overpayment scam, a “buyer” sends you a check or payment for more than the price, then asks you to refund the difference. The original payment is fake, so you lose the refund you sent. The FTC lists overpayments as a type of fake check scam.

The FTC’s advice is direct. Never use money from a check to send gift cards, money orders, cryptocurrency, or to wire money to anyone who asks you to. A fake check can look real. Once you send real money, it is almost impossible to get back.

In a domain deal, this looks like:

• A buyer pays more than agreed and asks for the extra to be sent to a “shipping agent” or “transfer partner.”
• A buyer wants you to move the domain first and says the check is in the mail.
• A buyer asks you to pay a fee to release a payment held “for compliance.”

Escrow takes these off the table because the seller is only paid after the escrow agent has verified funds. Never refund an overpayment, and never move the domain until funds are secured in escrow. Our seller guide shows the safe order of steps.

What payment methods are a warning sign?

Scammers prefer payment methods that are fast and hard to reverse. The FTC lists them as a sign of a scam: cryptocurrency, wire transfers through a company like Western Union or MoneyGram, payment apps, and gift cards. The FTC says never to pay someone who insists you can only pay one of these ways.

A caution on wire transfers. Wires are a normal part of real domain deals, since escrow services accept them. The difference is who you wire to. A wire to a licensed escrow company’s account that you found on its official site is normal. A wire to a person, or to an account a stranger gave you by email, is not.

How do I verify a domain broker is real?

Check what you can verify outside the broker’s own website. A real broker has a track record that independent sources report, uses a licensed third-party escrow service, and does not ask you for money to take your domain or make an offer.

Use this list.

1. Search for independent coverage. Look for deals reported by industry outlets and for named people with a history in the business.
2. Check public rankings. For example, Escrow.com publishes its Masters of Domains list of top brokers by volume. Grit Brokerage’s Brian Harbin appears on that list in 2022, 2024, 2025, and 2026, and you can check the list yourself at escrow.com/master-of-domains.
3. Ask how payment works. A real broker explains the escrow process and lets you pick or verify the escrow service. At Grit Brokerage, all sales go through a third-party escrow company.
4. Ask who the broker represents. A broker should say whether they act for the buyer or the seller, and what happens if the deal fails.
5. Check how they contacted you. A broker may email you first. That is not a red flag by itself. A request for money, logins, or an unusual payment method is.
6. Be careful with “anonymous” claims. Some real buyers hide their identity. A fake buyer often does too. Ask a broker how they confirm the buyer has funds.

You can read more about how brokers work in why you should use a domain brokerage and about pay in domain broker fees. The domain broker glossary entry has the basics.

What should I do if my domain is stolen?

Contact your registrar immediately and tell them you lost control. Time matters, because a stolen domain can be moved again. Then secure your accounts, document everything, and report the theft.

1. Call the registrar. Use the phone or support channel on the official site. Ask them to lock the domain and review the account’s recent activity.
2. Look up the domain. Use ICANN Lookup to see the current registrar and status codes. ICANN describes it as a tool for looking up the current registration data for domain names.
3. Secure your accounts. Change the password and turn on two-factor sign-in at the registrar. Check the email account tied to the domain, since attackers often get in through it.
4. Keep records. Save emails, transfer notices, order confirmations, and payment records.
5. Report the crime. File at ic3.gov, the FBI’s central point for reporting cyber-enabled crime. The site tells you to file even if you are unsure the case qualifies.
6. Check transfer rules. ICANN’s registrant FAQ says that if you think a registrar broke the Transfer Policy, you can file a transfer complaint with ICANN. Disputes between registrars over a fraudulent transfer go through the Transfer Dispute Resolution Policy, which registrars file, not owners.
7. Talk to a lawyer if needed. If the thief now holds the domain and you need it back, a lawyer can advise on options. This guide is not legal advice.

For the definition of the problem, see domain theft. To prevent it, keep the registrar lock on and your registrant email current. See how the lock works in how domain transfers work.

Where do I report domain fraud?

Report it in several places at once. Each one handles a different part of the problem.

Report even if you did not lose money. Reports help investigators see patterns.

If you paid a scammer, the FTC says to contact the company or service you paid right away. For gift cards, tell the card issuer and the store where you bought them.

How can I protect myself before I respond to an offer?

Slow down, check the offer, and keep every step inside a process you can verify. Most scams depend on speed and on you acting alone.

Before you reply to any offer, ask yourself these questions.

• Is the offer a specific price, or does it ask me to do something first?
• Did the buyer name an escrow service, and have I checked it myself?
• Have I logged in to my registrar by typing the address, not by clicking an email link?
• Does the sender’s email domain match the company they claim?
• Am I being asked to pay, refund, or share a code or password? If yes, stop.
• Never share your registrar password or your auth code with a buyer. The code goes only to the new registrar or into the escrow platform.

If a legitimate offer arrives, handle it through a broker or a licensed escrow service. Our guide to negotiating a domain purchase explains how real counteroffers work, and find a domain owner shows how real buyers locate sellers.

Next step

If you got an offer that you are not sure about, contact Grit Brokerage. If you want to sell, we can help you sell the domain through third-party escrow.