I'm glad I didn't procrastinate renewing my domain name for even longer. If I had, I would have gotten scammed. I almost did anyway.

Having read some of Kevin Mitnick's books about deception, one thing became clear about scams: you don't have to be dumb to get conned, and a scammer doesn't have to be a genius to pull it off. This is because a victim doesn't analyze the situation objectively, but rather subconsciously. And it's easy to abuse this. In my case, all the scammer needed was good timing and a tiny bit of context.

For the past month, I've been receiving reminders from my domain registrar, Spaceship, about renewing my domain name. I received the first email and checked the expiration date - which was about a month from then. Naturally, I proceeded to ignore new reminders for the next few weeks, until they got annoying so I finally renewed my domain.

At least I thought I did. Some time had passed and I got another email saying the domain needs to be renewed. It got me worried. I knew I'd gone through the renewal process a week prior. Maybe the payment didn't go through or there was a bug in their system? Did I let the domain expire? My first reaction wasn't a thought, but an emotion. I was afraid to lose the domain, even temporarily, so I decided to address it right away.

I clicked the link, passed the CAPTCHA check and found myself staring at the payment details page. Hold on, that's suspicious. Usually companies try to upsell you things before taking your money, or at least show you the details of what you're paying for. Even though using Spaceship had been a great experience with no dark patterns, this felt a bit too direct. I again thought about the payment I’d already made. Why would there be a problem with it?

Then I noticed a few more red flags, the biggest being the domain name: captcha-global.site/spaceship

Surely Spaceship isn't hosting its payment system there? It doesn't even look like a valid CAPTCHA website. Plus, there was no CAPTCHA the previous time I paid.

I went back to the email, and sure enough, it looked off:

A large, old-fashioned hyperlink to the real website and no personal information whatsoever. When compared to the real email, the difference is obvious.

But it was still an effective phishing tactic. Had I not paid for the renewal already, this email would have been perceived as a regular reminder. If you expect a handyman to come to your house, you're not going to question a guy with a toolbox who knocks on your door at an expected time — at least not right away. It's very likely that given the time pressure to renew, I would have just gone ahead with the fake renewal.

This realization was more fascinating than embarrassing. Here it was, something so simple and common, yet potentially very damaging.

Of course, knowing the nature of such scams, I can't expect to be immune to them. Instead, the goal is to build safeguards and reduce the possible damage.

Email and other communication channels like SMS or phone calls should be treated as notifications, not sources of truth, so it's always a good idea to find out what's really going on by visiting a website (or an official phone app) on your own. I also try to have a separate card for online payments. There isn't a lot of money on it, and the payment limits are in place.

There are many ways my 'system' could still fail me, though, especially since it only works in the realm of the internet. Plenty of scams take place at a time or place where a victim doesn't expect it, which is even more difficult to deal with. But time will tell.