What a domain change tells you before an invoice does
New name servers, a fresh certificate or a different registrar are often the first sign that a supplier's domain has changed hands.
whois.is team5 min read
Most payment fraud starts with a message that looks routine: a supplier you already pay sends new bank details. The email passes a glance, the logo is right, and the domain is one letter off or, worse, exactly the same.
Changes that matter
Before a domain is used against you, something about it usually moves. We watch for these:
- Name servers. A move to a new DNS host can mean the owner switched providers, or that someone else now controls the zone.
- Mail records. New MX records decide where replies to that supplier end up.
- Registrar and status. A transfer or an expired domain picked up by a stranger shows here first.
What to do when you see one
Call the supplier on a number you already have, not one from the email. A change is not proof of fraud, but it is a good reason to ask.
