Red flags list

At first contact

1. An unsolicited offer far above what the name is worth. The high number exists to make an unusual payment route seem reasonable later.
2. Pressure to move fast. A deadline invented by the other side, or a second buyer who does not exist.
3. A refusal to be identified. No legal name, no company number, no address, only a free email account.
4. An insistence on moving off the platform. A marketplace conversation that immediately proposes finishing the deal by direct transfer removes every protection the platform provided.
5. A named escrow service the other side chose and insists on. Fake escrow sites are built for exactly this moment.
6. A request for a valuation from a specific paid service before the deal can proceed. The valuation is the product being sold.

During verification

1. A screenshot instead of a live proof of control. A TXT record, a file at the site root or a nameserver change proves something; an image does not.
2. Delay on the control check. A genuine holder publishes a record in minutes. Days of excuses mean no access.
3. Registrar of record does not match what the seller states. Check the independent lookup, not the claim.
4. Status codes nobody mentioned. A registry hold, a pending delete or a redemption period means the name cannot be sold as described.
5. A registrant that cannot be reconciled with the seller, where the data is published at all.
6. An intermediary with no written authority from the party that actually holds the name.
7. An expiry date or registrar in the agreement that does not match the lookup. The full check sequence is in verifying the seller.

Around the payment

1. Bank details that change during the conversation. Treat this as interception until an out of band call proves otherwise, however plausible the explanation.
2. A receiving account in a different name to the party in the agreement.
3. A receiving account in a country neither side ever mentioned.
4. A request to split the payment across several accounts or methods.
5. A push toward an irreversible route with no explanation, particularly where a reversible route was available.
6. A payment from a third party on the buyer side, which can be a route to reversing the funds after the name is gone.
7. An escrow link sent inside a message. Type the address by hand and read it character by character; look for extra words, hyphens and unfamiliar extensions.
8. An escrow site with no verification step, or one that accepts a payment without an identity check. More signals are set out in spotting payment fraud.

During handover

1. A demand for the code before funds are held. The order is fund, transfer, release, and nothing else is an escrow arrangement.
2. A demand for release before the name is in the receiving account. A transfer in progress is not a completed handover.
3. A code that fails repeatedly while the seller offers a new explanation each time.
4. A lock that appears after the deal was agreed and is not backed by a registrar ticket number.
5. A transfer request for a different name than the one in the agreement.
6. Silence during the response window. A seller unreachable while a transfer is pending may be waiting for the request to lapse.
7. A request to extend the inspection period repeatedly without a registrar reason.

After the money has moved

1. The seller retains a recovery email or an alternative contact on the account.
2. Nameservers still hosted on infrastructure the seller controls.
3. The name still appears in the seller listings days after handover.
4. A payment reversal notice on a route that allowed one, arriving weeks later.
5. A dispute filed against the name shortly after the sale, suggesting it was sold because it was about to be lost.
6. A request to reverse the deal and return the name in exchange for a refund, in the same message thread.

One flag is a question. Two together is a stop. Pausing a genuine deal for a day costs nothing that cannot be recovered.