Home > Empowering Tips > The Hidden Threat of Fake Domains

In today’s digital world, a scammer doesn’t need a mask and a getaway car. They just need a convincing fake website domain.

Domain impersonation is a sophisticated form of online theft where criminals create a website or email address that looks almost identical to one you already trust — like your bank, a key supplier, or even your own company! Their goal is simple: to trick you into handing over money, passwords, or sensitive business data.

The bad news? These attacks are becoming incredibly common and highly sophisticated.
The good news? You don’t need to be a tech expert to spot the warning signs.

Let’s break down how this trick works and the simple steps you and your team can take to protect your business.

How Scammers Mimic Your Trusted Brands

Scammers use several clever tactics to make their fake domains look legitimate. These are the main “tricks” you should watch out for:

1. The Subtle Typo (Typosquatting)

This is the oldest trick, but it still works! The scammer registers a domain that is just a few letters off from the real one, hoping you won’t notice in a quick glance.

• Real: realdomain.com
• Fake: realdornain.com (‘m’ replaced with ‘r’ and ‘n’)
• Fake: reald0main.com (a zero ‘0’ instead of an ‘o’)

2. The Wrong Ending (Changing the TLD)

The “TLD” is the part at the very end of the website address (like .com or .org). Scammers will often use a different, less common ending to impersonate a brand.

• Real: legitimatesupplier.com
• Fake: legitimatesupplier.net or legitimatesupplier.xyz

3. Adding Extra Words (Subdomain Tricks)

The scammer will register a domain and then add a trusted company’s name to make it look official. Always look for the main domain name right before the first single slash (/).

• Real Domain: trustedbank.com/login
• Fake Domain: scammer.com/trustedbank (The real domain is scammer.com, not trustedbank.com).

The Red Flags: 5 Non-Technical Signs of a Fake Domain

Your eyes and common sense are your first line of defence. Pause and check for these five critical signs before clicking a link, replying to an email, or entering any credentials.

1. The Wobbly URL

• What to Look For:
  A tiny misspelling, an extra hyphen, or a strange ending (like .info or .co).
  Always hover your mouse over a link in an email to see the true address that appears in the corner of your browser/screen.
• Why It’s Suspicious:
  Scammers deliberately create “look-alike” domains to pass a quick glance.

2. Too Much Urgency

• What to Look For:
  The email/message demands immediate action or uses threatening language: “Your account will be suspended in 2 hours!” or “Final notice before legal action.”
• Why It’s Suspicious:
  Scammers use panic to stop you from thinking clearly and checking the details.

3. Generic Greetings

• What to Look For:
  The email starts with a vague salutation like “Dear Customer” or “Valued User”, even though the sender knows your name.
• Why It’s Suspicious:
  Legitimate companies use your name because they have your account details. Scammers use generic greetings because they are blasting the scam to thousands of people.

4. Poor Quality & Errors

• What to Look For:
  The website or email has obvious spelling mistakes, bad grammar, low-resolution logos, or a strange, unprofessional layout.
• Why It’s Suspicious:
  Professional companies invest heavily in polished communication. Errors are a huge giveaway of a hasty, fake site.

5. Lack of Security Lock

• What to Look For:
  The website address starts with http:// instead of https:// and has no padlock icon in the browser bar.
• Why It’s Suspicious:
  The “s” stands for secure. While some fake sites now get the padlock, its absence is a guaranteed red flag that the site is unsafe for entering any information.

How to Protect Your Business Today

Protecting your company is a team effort. Here are three simple, actionable steps for everyone:

1. Stop and Hover: Before clicking any link in an email, hover your mouse over it. If the address that pops up doesn’t perfectly match what you expect from the official company, do not click.
2. Verify Out of Band: If you receive an urgent or suspicious request (especially one involving a login or money transfer), do not reply to the email or call the number provided in it. Instead, open a new browser tab, go directly to the official company’s website (by typing the name yourself), or call a verified number you have on file.
3. Stay Educated: Make cybersecurity awareness a regular topic in team meetings. The more everyone knows about these common tricks, the less likely a scammer is to succeed.

Fake domains are designed to steal your company’s most valuable assets: its money, data, and customer trust. By being alert and knowing the simple signs, you can turn your staff into your strongest line of defence.