Owning a website means owning a set of accounts. There is the domain name, the hosting, the content management system and usually a few Google logins as well. Each one is a target for scammers who send fake emails dressed up as official notices.
These messages are a form of phishing. They are written to make you click a link and type in your details on a page the scammer controls. Knowing what they look like takes a lot of the risk away.
What phishing looks like for a website owner
Scamwatch describes phishing as scammers pretending to be trusted people or organisations so you hand over personal information. The contact can come by email, text, phone or a fake website. The messages often use official logos, branding and language so they look genuine.
For a business with a website, the trusted name might be your domain provider, your web host or a body that oversees domain names. The message usually claims something needs your attention right now. It then offers a link that seems to fix the problem.
Your hosting and server accounts are worth protecting for a simple reason. Whoever holds those logins can change your site, your email and your files. If you have read about choosing between Linux and Windows servers, you will know how much sits on that one account.
A real example aimed at .au domain holders
In June 2024 auDA, the body that administers the .au domain, warned about an email scam aimed at .au domain name holders. A third party posed as an auDA employee. The email asked people to click a link to confirm the contact details linked to their .au domain name.
The email claimed this step was needed to keep the domain licence. The warning advised people not to click the links, not to reply and not to send any personal identification or documents. You can read the auDA scam alert for .au domain holders for the full warning.
The statement also said that anyone unsure about an email claiming to come from it should contact auDA directly. People who had already handed over details were told to report it to their state or territory police and the Australian Cyber Security Centre. The statement noted that the ACCC’s Scamwatch had been told as well.
Warning signs to look for
Scamwatch lists several signs that a message may be phishing. Most of them are easy to check in a few seconds. Here are the ones that matter most for website owners:
- Unexpected contact claiming to be from a business you regularly deal with
- Pressure to act urgently
- The message does not use your proper name
- Sender details that do not match the real organisation
- A website address that is slightly off
- Small differences in sender IDs, such as extra dots, special characters or numbers
A notice about your domain, hosting or website login that tells you something is wrong fits this pattern well. It does not mean every such email is fake. It does mean you should check it another way before you click anything.
Check the message without using its links
The safest habit is to go to the account yourself. Scamwatch advises contacting the organisation using details from its official website, or logging in through its secure app or portal rather than a link. If there really is a problem, you will see it once you sign in the normal way.
Keep a short list of the companies that hold your domain, hosting and website. Save their login pages as bookmarks so you never need to rely on a link in an email. Then a strange notice from a company you do not use stands out straight away.
Scamwatch also suggests searching the exact wording of the message, or the sender’s email address, together with the word “scam”. Others have often reported the same message. Never open attachments from a message you were not expecting, as they can install harmful software.
Who should hold the website logins
Many small businesses hand the technical side to someone else. That is fine, but you should still know who manages each account and where notices are sent. If you are weighing up paying someone to build a WordPress website, ask them how logins will be shared and who will receive renewal notices.
Old contact details are a common gap. A former staff member or past developer might still be the contact on the domain. Updating those details means real notices reach the right person and odd ones are easier to spot.
The same applies when a business moves premises or changes its structure. If you are relocating your business, add the website accounts to the list of things to update. It is a small task that saves confusion later.
What to do if you clicked the link
Scamwatch says to act fast if you have clicked a link or shared details. Contact your bank or card provider straight away if you entered payment details. Change the passwords on your banking, email, government and shopping accounts.
For a website owner, also change the passwords for your domain, hosting and website logins. Use the official login page, not anything linked in the message. If you downloaded software, Scamwatch suggests having a qualified technician remove it.
Once your accounts are secure, report the scam to Scamwatch. The Scamwatch guide to phishing scams explains how to report it and where to get help. IDCARE offers free support for people whose identity details may have been misused.
Protecting the Google accounts tied to your website
Your website is often linked to Google tools such as Search Console, Analytics and a Business Profile. The Australian Cyber Security Centre notes that cybercriminals often use familiar brands and logos to seem reliable. A fake email using a well known logo should get the same check as any other.
Work on local SEO for a law firm website usually involves several of these accounts at once. Keep a record of who owns each one and who has access. Remove people who no longer need it.
Frequently asked questions
Does auDA email me to confirm my domain details?
auDA has warned about scam emails pretending to come from its staff. Its advice is to contact auDA directly if you are unsure about any email claiming to be from it. Do not use the links or contact details in the email itself.
How can I tell if a renewal notice is real?
Log in to your account with the company that manages your domain, using your own bookmark. If a renewal is due, it will show there. A notice from a company you have never dealt with is a strong reason to stop and check.
Where do I report a phishing email?
Scamwatch, run by the ACCC, takes reports of scam messages. If you gave out details in response to the fake auDA email, auDA also advised reporting it to police and the Australian Cyber Security Centre. Secure your accounts first, then report.
What if I already entered my password?
Change that password straight away through the official login page. Change it on any other account where you used the same password. If payment details were involved, contact your bank or card provider as soon as you can.
Scam emails change their wording often, so the details above will not cover every version. The habits stay the same. Check the account yourself, keep your contact details current and report anything suspicious.