Common domain scams in Pakistan and how to avoid them

Fake renewal invoices

This is the scam most business owners meet first. An email or WhatsApp message arrives saying your domain is about to expire. It carries an invoice and a payment link. Often the sender is not your registrar at all. The aim is to take your card details or a bank transfer.

ICANN, the body that coordinates the domain system, says it does not collect fees from registrants directly. Those payments are between you and your registrar. ICANN also says to treat any renewal offer that claims to come from it with suspicion. Fake notices often copy its name and use a lookalike sender address.

• Do not click the link in the message.
• Log in to your registrar or PKNIC account yourself and check the real expiry date.
• Compare the sender address letter by letter with the company you actually bought from.
• Be wary of any message that adds pressure, such as 'pay within one hour'.

Sellers who take the money and never transfer

Someone lists a good name at an attractive price. You pay part or all of it up front, often by Easypaisa, JazzCash or bank transfer. Then the seller goes quiet, blocks you, or keeps asking for 'small extra fees'.

The risk comes from paying before you hold any control over the name. Once a rupee transfer is sent to a stranger, getting it back is slow and uncertain.

The safer pattern is simple. Pay only when the money is held by a neutral party and released after the domain reaches you. This is how our marketplace works. Sellers list names at /#browse, and we hold the payment in escrow until the transfer is complete. If you are the owner, you can list a name at /#sell.

Domains registered in the seller's name, not yours

Some freelancers and web agencies register a domain for a client but put their own name on it. Everything looks fine until the relationship ends. Then they refuse to hand it over, or ask for more money.

The registrant is the legal holder of the name, so the name on the record matters. For .pk and .com.pk names, PKNIC fixes the registrant name at registration, so a wrong name cannot simply be edited later. Start with your own name or your company's name.

When we register a new name, it goes in the customer's own name. See /register-pk-domain/ for how that works. Whoever builds your site, ask for the registration record before the project starts.

Fake payment screenshots

Buyers can be scammers too. A buyer sends a screenshot showing a Raast or bank transfer, asks the seller to release the domain, and the money never existed. Screenshots are easy to edit, and a sent-looking receipt is not a received payment.

If you are selling, never release a name because of an image. Open your own bank, JazzCash or Easypaisa app and confirm the money has arrived. Check the amount, the sender name and the time. Be careful with claims such as 'the bank is slow today' or 'I sent too much, please refund the difference'.

Selling through escrow removes this problem, because we confirm the payment ourselves before anything moves. See /sell-domain/ for the steps.

Checks to make before you pay or transfer

A few minutes of checking stops most of these scams. Do them in order and keep a record of each step.

Fees can also help you spot nonsense. PKNIC lists Rs 2,100 per year for registrants based in Pakistan (from 1 August 2026) and USD 15.99 per year for overseas ones, with a two-year minimum term. A quote far from those numbers for a plain .pk registration deserves a question. Read /pk-domain-price/ for the full picture.

• Ask who the registrant is, and look up the public record where the extension allows it.
• Confirm the expiry date. A name that expires next week is a poor purchase.
• Never pay a stranger by direct transfer before you control the name.
• Confirm incoming money in your own app, not through a screenshot.
• Keep chats, receipts and the registration record together.
• If something feels rushed, stop and ask us on WhatsApp.

Common questions