The invoice looks official: your domain name, a due date, a PKR amount, a bank account. It is a scam — and it works because it arrives when renewal anxiety is real. Here is the verification habit.
The anatomy of the scam - Unsolicited invoice/renewal notice from a ' registrar' you never used - Pressure timelines: 'expire in 48 hours, service interruption' - Payment to a personal bank/wallet account - Sometimes: your real domain data (WHOIS is public — knowledge of your domain proves nothing)
The verification habit (three checks, thirty seconds) 1. WHO matches: check the SENDER's actual address (not the display name) against your real registrar/host — invoices only come from accounts you opened 2. WHAT matches: log into your actual hosting/domain panel — the real expiry and price are there. Any 'renewal' not visible in your panel is fiction 3. WHERE matches: payments go ONLY to the account your real provider's official page lists — never to an account an invoice email introduces
The variants to know - 'Your domain expires today' calls/emails (registrar impersonation) - 'Your listing/registration needs renewal' directories you never joined - 'Google support' callers selling listing services - WhatsApp 'your hosting will be suspended' from unknown numbers All share the pattern: urgency + payment to a new account + unverifiable outside your own panel.
The house rule that ends the risk Payments to hosting/domain providers are made ONLY by logging into your verified account panel — never from invoice links, never to newly-introduced accounts. One rule, zero exceptions, scam-proof.
Kairalmas renewals: visible in your portal, reminders from the official number (923125893198), payments producing receipts in your wallet. If any 'Kairalmas invoice' lacks those three things — it is not us. Report it on the official WhatsApp.