Web Design Red Flags and Scams: How to Spot Them Before You Pay
Common web design scams and warning signs, including fake domain notices, guaranteed rankings, hijacked domains and lock-in contracts, with steps to verify and report.
The most common web design red flags are unsolicited messages claiming your site or domain has a problem, guarantees of first-page search results, pressure to pay immediately, refusal to put terms in writing, and arrangements in which the provider controls your domain or code. Most providers are honest, but small business owners are frequent targets of both outright scams and legal-but-predatory contracts. This guide describes the patterns, explains how to verify a claim and says what to do if you have already paid.
Category 1: Outright scams
Fake domain renewal or expiration notices
You receive an official-looking letter or email saying your domain is about to expire and that you must pay a "registration" or "search engine listing" fee. Often the sender is not your registrar at all. Some notices look like invoices and are designed to trick you into paying or transferring your domain.
How to verify: log in to your registrar directly, using a bookmark rather than a link in the message, and check the expiration date. If the sender is not the company where you registered, treat it as suspect. Do not call phone numbers or click links in the notice.
Fake "your site has errors" alerts
Cold calls or emails say your site is broken, hacked or failing a security scan, and offer to fix it urgently for a fee. Real problems rarely arrive with a sales pitch. How to verify: check the site yourself and contact your own provider.
Phishing for logins
Messages pretend to come from your host, builder or payment processor and ask you to log in through a link to avoid suspension. How to verify: go to the provider by typing the address yourself and look for the alert in your account.
Fake invoices
Fraudsters send invoices for services you never ordered, hoping accounts payable will pay without checking. How to verify: match every invoice to a purchase order or contract. Establish an approval process for new vendors.
Take the deposit and disappear
A provider collects a large deposit or full payment, delivers little or nothing and stops responding. How to protect yourself: pay in milestones, use a payment method with dispute rights such as a credit card, and avoid wire transfers and gift cards to unknown parties. Gift card and wire payments are common in fraud because they are hard to reverse.
Category 2: Misleading claims
Guaranteed search rankings
No outsider can honestly guarantee a specific search position, because rankings are controlled by search engines and change over time. Guarantees are often paired with vague claims such as "we have a special relationship with the search engine." What to ask instead: which activities are included, how results will be measured, and what happens if goals are missed.
Unrealistic traffic or sales promises
"Double your sales in 30 days" is not a plan. Look for providers who describe what they will do, not what they cannot control.
Fake portfolios and testimonials
Some providers display other designers' work or invented reviews. The Federal Trade Commission prohibits fake reviews and deceptive endorsements. How to verify: ask for live links, contact the site owners and check that the provider's name appears in the site's credits or can be confirmed by the client.
Hidden charges
Prices that look low because essential items are excluded, such as hosting, content, search setup, a premium theme, or even the ability to edit your own pages. How to check: request a list of every cost over two years.
Category 3: Legal but risky arrangements
Provider-owned domain or hosting
When the provider registers and controls your domain, they hold leverage over you. Transferring the domain may be refused or may carry a fee. Fix: register your own domain and use your own account.
Long subscription lock-ins
A low or free build price paired with a monthly fee and a multi-year minimum can cost more than a regular build and leave you without the code. Fix: multiply the monthly fee by the total number of months and add termination and transfer fees. Compare with a standard one-time build. See contract and ownership terms.
Proprietary platforms with no export
Some providers build sites on closed systems that cannot be moved. If you leave, you start from scratch. Ask: can I export my pages, images and data in a usable format?
Auto-renewing add-ons
Plans for security scans, search optimization or support may renew silently. Fix: list every service, its renewal date and cancellation process.
Outsourced work presented as in-house
Not always bad, but you should know who is doing the work and how your data and logins are handled. Ask: will any subcontractors have access to my accounts?
Warning signs in how they sell
| Warning sign | Why it matters | What to do |
|---|---|---|
| Contacted you unprompted about an urgent problem | Common scam opening | Verify independently; ignore pressure |
| Must pay today for a discount | Prevents comparison and thought | Walk away or ask for written terms |
| No written proposal or contract | No proof of what was promised | Require a written scope |
| Will not name past clients | Cannot verify claims | Ask for live sites and references |
| Payment only by wire, gift card or crypto | Hard to dispute or reverse | Use a card or other protected method |
| Guarantees rankings, traffic or sales | Outside their control | Ask for process and measurement |
| Insists on keeping your domain or logins | Creates dependence | Insist on ownership |
| Vague about who does the work | May be outsourced without disclosure | Ask for names and roles |
A verification routine for any new provider
- Search the provider's name together with words such as "reviews" or "complaints" and check the Better Business Bureau profile.
- Open at least three of their live sites on your phone and look for a credit line or ask the owner.
- Call two references and ask about problems.
- Check how long their business has existed and confirm a physical or registered business address, for example through your state's business registry.
- Confirm that the person you are dealing with has authority to sign the contract.
- Pay a small first milestone and see how they handle it.
Worked example: a fake renewal notice
A small business owner receives a letter titled "Domain Registration Notice" with a bold deadline and a $149 charge for a two-year "listing." The company is not their registrar. Their actual domain does not expire for eight months, and the cost to renew with the real registrar is much lower. Because the owner logs in to their registrar, checks the date and ignores the letter, they avoid paying $149 for nothing. If they had paid, they might also have authorized a transfer of the domain away from their real registrar, which would create a mess. Checking takes five minutes.
What to do if you have been scammed
- Stop paying. Do not send additional money to "fix" the problem.
- Contact your bank or card issuer right away. Ask about disputing the charge or stopping a transfer. Time limits apply.
- Secure your accounts. Change passwords on your registrar, hosting, email and payment accounts, and turn on multi-factor authentication.
- Document everything. Save emails, invoices, screenshots and call notes.
- Report it. In the United States, you can report fraud to the Federal Trade Commission at ReportFraud.ftc.gov, to the FBI's Internet Crime Complaint Center at ic3.gov and to your state attorney general. You can also file a complaint with the Better Business Bureau.
- Consider legal advice. For significant losses or contract disputes, consult an attorney.
Frequently asked questions
How can I tell if a domain notice is real?
Log in to your registrar by typing its address yourself and check your expiration date. If the notice comes from a company you do not use, treat it as a solicitation or scam.
Are all subscription web services bad?
No. They can suit owners who want predictable monthly costs. The problem arises when ownership, exit terms and total cost are unclear. Read the contract and calculate the full cost.
Is it a scam if a provider's price is very low?
Not necessarily, but a very low price deserves questions about scope, quality, ongoing fees and ownership.
What if I already signed a bad contract?
Read the termination and dispute clauses, keep records and consider speaking with an attorney. Some disputes are resolved by negotiation.
Sources
- Federal Trade Commission — report fraud and read business guidance on scams.
- FBI Internet Crime Complaint Center — report internet-enabled fraud.
- Better Business Bureau — business profiles, complaints and scam tracker.
- ICANN — domain registrant information and how to check domain ownership.
