Spotting payment fraud in domain deals

Fraud in domain deals almost never involves a clever technical attack. It involves a plausible story, a payment route that cannot be reversed, and pressure to act before anyone checks anything. The defence is a fixed sequence of checks that does not vary with how convincing the other side sounds.

The fake escrow site

The most common setup. The counterparty proposes escrow, which sounds reassuring, then supplies a link to a provider the other side has never used. The site looks like a real escrow platform, produces a transaction that mirrors a genuine one, and confirms receipt of funds that went straight to a personal account.

Signals worth acting on:

• The escrow provider was suggested by the counterparty and appears only through a link that was sent rather than typed.
• The domain of the escrow site is a near miss of a known name, or uses a different extension to the one the real provider uses.
• Payment instructions name an individual rather than a company, or a company whose name does not match the platform.
• The account is in a country unconnected to either party or to the platform's stated address.
• The site pushes for a bank transfer or crypto and does not support any reversible method at all.

The countermeasure is procedural: reach the escrow provider independently, through a search or a previously saved address, and open the transaction from there. Never from a link in the negotiation thread.

Changed bank details in a reply

An invoice arrives, then a follow up message says the account has changed, often citing an audit or a bank problem. The message comes from an address that differs from the original by one character, or from the real address after a mailbox compromise.

The rule that defeats this: bank details are confirmed once, by voice, on a number obtained separately from the emails. Any change to those details restarts that confirmation. Urgency in the message is a reason to slow down, not to hurry.

Payment details that change mid deal are treated as fraud until proven otherwise, regardless of how ordinary the explanation sounds.

A seller who does not control the name

The seller is real, the name is real, and the two are unconnected. The setup relies on the buyer checking that the domain exists rather than checking who holds it. Often the name is genuinely for sale somewhere, and the fraudster has copied a listing.

Signals: the registrant record does not match the seller's stated identity and the seller cannot explain the difference; requests for a control check are deflected as unnecessary; the seller declines to open a marketplace listing or an escrow transaction that would require identity verification; the name is inside a registrar the seller cannot name correctly.

A control check settles it in minutes, and the methods are described in verifying the seller.

The buyer who reverses payment after transfer

The mirror image, aimed at sellers. Payment arrives through a method with a long reversal window, the name transfers, and weeks later the funds are pulled back through a chargeback or a dispute. By then the name has usually moved on again.

Signals: the buyer insists on a payment method that favours reversal and rejects escrow; the payment comes from an account in a different name to the buyer; the buyer asks for the transfer to complete before the payment has cleared; the buyer wants the name pushed to a third party account. The mechanics of the reversal itself are covered in chargebacks and reversals.

Overpayment and refund requests

An amount larger than agreed arrives, followed by an apology and a request to return the difference to a different account. The original payment is later reversed and the refund is not. The rule is simple: an incorrect payment is returned in full to the exact account it came from, after it has cleared, and never to a different one.

Signals that apply to every variant

• Pressure to complete before a stated deadline that only the counterparty benefits from.
• Refusal to use a method that requires identity verification.
• A payee name that does not match the party in the negotiation.
• Communication that moves off the platform where the deal started.
• An unwillingness to answer a factual question with a factual answer.

None of these is proof on its own. Two together in the same deal is enough to stop and re run the checks in the red flags list before anything else happens.