How to buy a domain name safely

Buying a domain name from its owner usually means sending a stranger more money than you would normally send a stranger, for something you cannot hold in your hand. That is a fair reason to be careful. It is not a reason to avoid the purchase: the risks are well understood, and nearly all of them come down to one thing, which is the order in which the money and the domain move.

Here is how to keep that order right, and what to watch for along the way.

The one rule: the money waits for the domain

In a safe sale, the seller never receives your money until the domain is in an account you control. Everything else in this article is a way of making sure that rule holds.

The usual way to hold it is escrow. A licensed escrow service such as Escrow.com takes your payment, tells the seller it has the money, waits while the seller transfers the domain, and releases the payment only after you confirm the domain has arrived. If the transfer never happens, the money comes back to you. Neither side has to trust the other, because neither side goes first.

Large marketplaces run their own version of the same arrangement. Whichever is used, the shape should be the same: money held by a third party, released on delivery.

Checks to make before you pay

1. Confirm who you are dealing with. A listing on a marketplace, a landing page on the domain itself saying it is for sale, or an email from an address on that same domain are all reasonable signs that the person selling is the person who controls the name.
2. Look the domain up. A registration lookup (often called WHOIS or RDAP) shows which registrar holds the name, when it was registered and when it expires. Owner details are usually hidden for privacy, which is normal and not a warning sign.
3. Ask how long the seller has held it. A name that changed hands or was registered within the last sixty days may be locked against moving to another registrar for a while. That is a registry rule, not stalling, but it is worth knowing before you agree a date.
4. Get the price and what it includes in writing: the figure, the currency, who pays the escrow fee, and how the transfer will be done.
5. Check that the name is clear for what you plan to do with it. A short search for businesses already trading under the same name in your field, and advice if anything looks close, costs far less than a dispute later.

Warning signs

Most domain sale scams are not clever. They rely on the buyer being in a hurry. Slow down if any of these appear:

• A request to pay the seller directly, by bank transfer, gift card or cryptocurrency, before the domain moves.
• An escrow link that arrives by email and opens a site you did not type yourself. Fake escrow sites exist for exactly this transaction. Go to the escrow service by typing its address, and check every character in the address bar.
• Pressure to decide today because another buyer is about to pay. Real sellers do have other enquiries, but a genuine one will still use escrow and still wait for the transfer.
• A seller who refuses escrow altogether, or will only use a service you have never heard of and cannot find independent mention of.
• Details that change halfway through: a different payment name, a different account, a new email address.

None of these prove fraud on their own. Together, or in a hurry, they are reason enough to stop and use a route where the money waits.

During the transfer

A domain moves in one of two ways. If you and the seller use the same registrar, the seller can push the domain into your account there, which is quick. Otherwise the seller unlocks the domain and gives you an authorisation code, and you start the transfer at your own registrar. Registrars usually add a year of registration when a domain transfers in, which you pay for.

Only confirm delivery to the escrow service once the domain shows in your own registrar account, under your login. A screenshot from the seller is not delivery. Neither is a domain that points at your website but still sits in somebody else's account.

After it arrives

• Turn on auto-renew and keep the payment card current. A lapsed renewal is the most common way people lose a name they paid for.
• Turn on two-factor authentication for the registrar account and for the email address the account recovers to.
• Switch on the registrar lock once everything has settled, so nobody can start a transfer without you.

The longer walk through the whole process, from first offer to transfer, is in How buying a domain name actually works.

How it works on Webba

Every sale on Webba goes through Escrow.com, so the money always waits for the domain. On Webba's current terms the escrow fee is paid by the seller. The transfer normally completes in one to five days, and Webba handles the authorisation code and the registrar push. Every name sold is covered by a 100% Money Back Guarantee: you get the domain, or your money back. The details are in Transactions, Escrow & Cancellations.

If you have a question before you commit, every name page has a way to ask one, and a person answers. You can start from every name A to Z.