Friday, 3:10 p.m. Suppose you are the controller of a hypothetical pump manufacturer in Duluth. Your longtime castings vendor calls about a past-due invoice. You tell him it was paid on Wednesday, $146,000 by wire, to the new account. There is a short silence. "What new account?"

You pull up the email. It came from a name you know at redwood-castings.com. The vendor's real address is redwoodcastings.com, and you can't believe you never noticed the hyphen. It's late on a Friday, the wire is two days old, and the next few decisions will matter more than anything anyone does on Monday.

Most people in that chair do the natural thing, which is to get on the phone with IT and look for the domain's owner. The first call should actually go to the bank. This guide gives the sequence, says who should do what, and explains the reason for each step. For the doctrine behind it, read Lookalike Domains and Typosquatting: Phishing, Invoice Fraud, and the Legal Tools That Take Them Down.

The short answer

  • Run three tracks at once. Money (bank and FBI), mailbox (is an intruder in your systems), and domain (takedown). Each needs its own owner, and the money track goes first.
  • Call the bank's fraud desk within minutes of discovery, not hours. Ask for a recall, ask for the receiving bank to be notified of fraud, and ask what indemnity paper the bank needs.
  • File with IC3 the same hour, with complete transaction details. In 2025 the FBI's Financial Fraud Kill Chain process froze 58 percent of the attempted theft in the incidents it handled.
  • Capture evidence before you report the domain. A takedown can erase the page and the DNS records. Thirty minutes of capture will support everything later.
  • Send abuse reports in parallel on day one, to the registrar, the mail provider, the host, the CDN, and the browser blocklists. Write them so a tired analyst can decide within a minute.
  • Escalate on a schedule. Go to the registry, and then ICANN Contractual Compliance, if the registrar stalls. ICANN sets no fixed deadline, so your report should create a record that shows time passing.
  • Use the UDRP for the long game. It needs a trademark, costs a small fee, and takes about two months. The URS is faster but ends in suspension and does not reach .com or .net.
  • Go to court when the harm is large or ongoing, the registrar won't move, or the campaign keeps coming back. Have your facts in declarations first. A TRO that isn't ready on day five usually loses to an abuse report that worked on day two.
  • Don't file an in rem case in a way that freezes a pending suspension. The statute bars registrars from modifying a name during the action without a court order.
  • Assume a dispute with your counterparty and your insurer. Preserve the facts now, and don't make admissions in the heat of the first call.

Before anything else: sort the problem

Spend five minutes on four questions. They decide which parts of this guide you need.

1. Has money left, or is it about to? If a payment is pending, stop it. If it has gone, go straight to the next section. Check for other payments too, and for changes in the vendor master file. Fraudsters who succeed once often try again before anyone notices.

2. Which way is the attack facing? There are two common patterns, and many incidents involve both.

Pattern Who is the victim first What it looks like Your standing
Inbound You, as payor Someone imitates your vendor, lawyer, or executive to get you to pay Possibly no trademark rights, since the imitated name is someone else's. You have bank, FBI, and abuse-report options, and you can tell the imitated company.
Outbound Your customers Someone imitates you, to bill your customers or harvest their passwords Your mark, so all the trademark tools are available. You have reputation and customer-warning issues.

The first pattern surprises people. If redwood-castings.com imitates your vendor, you may not have standing under the UDRP or the ACPA, because those remedies belong to the mark owner. Your vendor does. Call the vendor at a known number and ask it to file, or get written authorization to report on its behalf. ICANN's complaint guide asks a person complaining on behalf of an impersonated entity to attach proof of authorization.

3. Is your own mailbox compromised? How did the fraudster know the invoice number, the amount, the contact's name, and the thread's subject line? If the answer isn't obvious, assume an intruder sits in a mailbox on one side. Lookalike domains and compromised mailboxes are frequently parts of one scheme.

4. Is the domain malicious or compromised? A name registered days ago, one character off a brand, with hidden registration data, is almost certainly malicious. A long-standing small business website that suddenly hosts a bank login page has probably been hacked, and that owner is another victim. Registrars treat those differently, and so should your report.

Assign owners

In a small company one person may fill several seats. Name them anyway, and don't run the response by email from a mailbox that might be compromised. Use phones and a separate channel.

Track Owner Backup First deliverable
Money CFO or controller Outside counsel Bank fraud case number, IC3 complaint ID
Mailbox and systems IT lead or incident response firm, under counsel's direction Managed service provider Sign-ins, rules, and mail-log search results
Domain and evidence IT or security, with counsel Takedown vendor Evidence folder, abuse reports sent
Communications Executive sponsor Counsel Internal notice, counterparty call list
Legal and insurance General counsel or outside counsel Broker Hold notice, insurer notice, forum decision

Hour zero to one: chase the money

Call the bank

Call your relationship manager and the fraud or wire room. Do not wait for email. Your first sentence should be something like: "We are reporting a fraudulent wire. We need a recall sent now and notice to the beneficiary bank. Please open a fraud case and give me the number."

Have these ready: originating account, date and time, amount, beneficiary name and account number, beneficiary bank and routing or SWIFT code, the Fedwire reference (IMAD/OMAD) or SWIFT reference (UETR) if you have it, and how you learned of the fraud.

Three things to ask for, in this order:

  1. A recall and a direct call to the beneficiary bank's fraud department. A message that sits in a queue until Monday is worth much less than a phone call today.
  2. What paper the bank needs. The FBI's domestic process summary tells victims to request a recall or reversal and a hold harmless letter or letter of indemnity. Under UCC § 4A-211, after the beneficiary's bank has accepted an order, cancellation depends on that bank's agreement or a funds-transfer system rule, and the sending bank may ask you to cover its exposure. Have an officer ready to sign, and have counsel glance at it, but don't let the wording of a form burn a day.
  3. Written confirmation. Get the time, the name, and the case number. Follow up in writing from a clean address. The letter is in the Lookalike Domain Toolkit: Abuse Reports, Registrar Demands, and UDRP and URS Outlines.

If you have the beneficiary bank's fraud contact, you or counsel should also send it direct notice, in writing, that the account is receiving proceeds of fraud. Under Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union, 133 F.4th 264 (4th Cir. 2025), a beneficiary's bank without actual knowledge of a name and number mismatch at deposit has no liability under § 4A-207, and an unread machine alert isn't knowledge. A specific human-readable notice is a different thing. It may not create liability, particularly given the privity limit in Approved Mortgage Corp. v. Truist Bank, 106 F.4th 582 (7th Cir. 2024), but that same case left room for a claim about what a bank does with funds after credit, and the notice may lead a compliance officer to hold what's left. Send it. Stick to facts, and don't threaten.

File with IC3

File at ic3.gov within the hour. The form isn't long. The FBI says it is vital that the complaint contain all required data, including the banking information, and the 2025 IC3 report says to file regardless of the amount lost.

The IC3 Recovery Asset Team runs the Financial Fraud Kill Chain (FFKC), a process for getting recipient banks to freeze funds. It handled 3,900 incidents in 2025 and froze about $679 million of about $1.16 billion in attempted theft. Domestically, it can reach past the first recipient if you supply "second hop" details. Internationally, it works through FinCEN's Rapid Response Team and FBI legal attachés. Eligibility isn't spelled out in a public rule, and the requirement practitioners repeat is simply speed; people commonly speak of a 72-hour window, but treat that as a rough description, not a promise. If you know your local FBI field office's cyber squad, call it as well, and give it the IC3 number. Large-dollar matters tend to get attention through both channels.

For a smaller loss, or if the FBI does not engage, report anyway. Your complaint can link your case to others. In one 2025 matter described in the IC3 report, a recipient account from a real estate wire fraud turned up again in a city government's $6 million loss.

Keep expectations realistic. In Studco, the FBI investigated, the scammers were never identified, and none of the money came back.

Stop the next payment

Freeze changes to vendor banking details across the company for 72 hours. Pull every payment made in the past 90 days to any account that changed recently, and check with each of those vendors by phone at a number from the original contract. Fraudsters reuse their success.

Hours one to four: preserve the evidence

This step comes before takedown reports. The page might disappear within hours of your first report, which is the goal, but it would also be your exhibit. Authentication is the rule you are working toward: Fed. R. Evid. 901 requires evidence sufficient to support a finding that the item is what you claim, and Rule 902(13) and (14) allow self-authentication of records generated by a process and of copied data verified by hash, through a qualified person's certification. See Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court.

Create one evidence folder with restricted access and a simple log saying who captured what, and when, using which tool. Capture:

The messages. Export the original email as .eml or .msg, not a forward or a screenshot. A forward strips headers. In the headers, the fields that matter include the From and Reply-To addresses (which often differ), Return-Path, each Received line, the Authentication-Results line, the DKIM signature's d= value, and the Message-ID. Get every message in the thread, including those to other recipients.

The domain's records. Run these at once, because they change:

whois example-lookalike.com
dig +short NS example-lookalike.com
dig +short A example-lookalike.com
dig +short MX example-lookalike.com
dig +short TXT example-lookalike.com
dig +short TXT _dmarc.example-lookalike.com

Also save a lookup from ICANN Lookup. Note the creation date, registrar and IANA ID, registrar abuse contact, name servers, and status codes. If the name contains non-Latin characters, record both the display form and the xn-- form. Search the certificate transparency logs (crt.sh is a free public interface) for certificates and sibling names, which may reveal related domains.

Any website. Open it from an isolated machine or a sandbox, because it may carry malware. Capture full-page screenshots showing the URL and date, the saved HTML, and any redirect chain. Do not enter real credentials. If a security firm does this, have it document its method.

Internal records. Save the payment file, approval trail, bank confirmations, invoices, vendor master change log, call logs, phone records of any verification call, and the employee's account of events, written promptly and directed to counsel.

Hold notice. Issue a litigation hold now. A dispute with the counterparty, the bank, or the insurer is reasonably foreseeable, and Fed. R. Civ. P. 37(e) governs lost electronically stored information. Suspend auto-delete for the mailboxes and logs involved. Mail and sign-in logs often have short default retention periods, so export them today.

Hash it. A SHA-256 hash of each file, recorded in the log, lets a certification under Rule 902(14) do its job later. For the certification forms, see Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications.

Consider having outside counsel engage any forensic firm, so that work done to get legal advice has the best shot at privilege. The privilege is far from automatic; see Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege.

Hours one to eight: contain and communicate

Contain

Blocking the domain at your mail gateway and DNS filter takes minutes. Then search mail logs for all traffic to or from the domain and for any related domains found in the certificate search. Purge delivered copies only after preserving them.

If there is any sign of compromise, work through the mailbox as an intrusion:

  • Review sign-ins for unfamiliar locations, devices, and legacy protocols.
  • Check for inbox rules that forward or hide mail. In Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., 759 F. App'x 348 (6th Cir. 2018), rules moved the buyer's messages to the deleted items folder and forwarded them to a look-alike Gmail account. That's the signature you're hunting for.
  • Check for mailbox delegation and third-party OAuth app grants.
  • Revoke sessions, then reset passwords. Doing only the second can leave a stolen session token working. Modern phishing kits can capture a session even when the victim used a one-time code, so move affected users to phishing-resistant MFA.
  • Export the audit logs before changing too much.

If personal information was in the mailbox, a state breach-notification analysis may follow, with its own deadlines. See Data Breach and Incident Response Toolkit: From Detection to Notification.

Tell your people

Send a short notice to finance, procurement, sales, and executives. Keep it factual and don't assign blame. The clerk who released the wire is your most important witness, and a frightened witness forgets things. A useful version reads: "We've seen fraudulent emails from addresses resembling a vendor's. Do not change any payment details for any party without calling a number from our master file. Report anything from [domain] to [person]. Do not reply to it or discuss this outside this group."

Limit written speculation. Messages like "how did we miss this?" are discoverable unless privileged, and they will be read back to you in the later fight about who was in the best position to spot the fraud.

Tell your counterparty

Call the imitated company today at a known number. You owe that to them as a matter of decency, and it also helps you legally. In Bile v. RREMC, LLC, 2016 WL 4487864 (E.D. Va. Aug. 24, 2016), as described in Beau Townsend, a lawyer who learned of a diversion attempt and did not warn opposing counsel left his client with the loss when the fraudster succeeded two days later. Silence after notice can decide the case.

Stick to facts on this call: what you received, from what address, on what dates, and that you've reported it. Ask them to check their own mailboxes and to preserve records. Don't discuss fault or who owes what. That conversation should wait for counsel. Ask for a named contact and for written authorization to report the domain on their behalf, unless they will do it themselves.

Warn customers if they're the targets

In the outbound pattern, warn customers fast, and tell them precisely what to look for. Good warnings give the real domain, the fake domain written so it can't be clicked (for instance, example-lookalike[.]com), what the fraudster is asking for, and a number to call. Tell them you don't change bank details by email. Publish the notice on your website, too, because a customer who is suspicious will look there.

Be careful about saying who did it, or that a specific named business did, unless you know. Don't speculate about whether you were breached before you know. For regulated businesses and public companies, check for other disclosure obligations.

Hours four to 24: abuse reports

Now send reports, all on the same day. The goal is that any one of them could stop the fraud, because the mail provider might respond faster than the registrar.

Identify the targets

Your DNS records show you who to contact.

Record What it tells you Who to notify
RDAP/WHOIS registrar Sponsor of the name Registrar abuse contact
TLD Registry Registry abuse contact, on escalation
MX Who handles mail Mail provider abuse desk
A Who hosts the web server, unless proxied Host
NS or A resolving to a CDN Proxy in front of the site CDN abuse form
Links within email Credential or payment pages Their hosts and registrars too
Reply-To and phone numbers Fraudster's other accounts Email provider; VoIP carrier
Bank account in the invoice Mule account Your bank and IC3

Write a report that gets acted on

A trust and safety analyst may read hundreds of these. A good report lets that person reach "yes" quickly, and it maps to the words of the contract. Under § 3.18 of the Registrar Accreditation Agreement, the registrar must have an abuse contact, confirm receipt, investigate, and, on actionable evidence of DNS Abuse, promptly act to stop or disrupt it. ICANN's advisory says evidence is actionable when it supports a reasonable determination.

Include:

  1. Subject line that says what it is. "Phishing/impersonation: example-lookalike.com, active fraud, urgent."
  2. Who you are and your relation to the imitated party. Attach authorization if you are not the owner.
  3. The domain, and that it is maliciously registered. Give the creation date, the real company's domain and how long it has been in use, and the character difference.
  4. What it is doing. Be concrete: it hosts a copy of a sign-in page at this URL, or it sends email from this address soliciting bank credentials and redirecting payments.
  5. Evidence. The email with full headers, a screenshot with the full URL, and the MX record showing it can receive replies.
  6. Harm and urgency. Money lost and more at risk; a case number from IC3 or a police report.
  7. The action you ask for. Suspension, with a transfer lock, and preservation of account records for law enforcement. Ask them to review other names on the same account.
  8. A contact who will answer. Include a phone number.

Do not bury this in legalese. Leave out the demand for damages, the trademark portfolio, and the threats. And mention § 1114(2)(D) only if a nervous registrar needs it: under 15 U.S.C. § 1114(2)(D), a registrar that disables a name under a reasonable policy against confusingly similar registrations has protection from monetary relief.

Describe it accurately. ICANN's definition of DNS Abuse includes phishing but not fraud in general, and ICANN's own guide treats other fraud as a separate category. If your case involves a credential page or an email asking for sensitive financial information, use the word phishing, and explain why. If it is a pure payment redirection, say that the email impersonates a named company and solicits bank and payment information under a false identity, and that the registrar's duties under § 3.18.1 and its own terms of service apply in any event. Calling a normal gripe site phishing costs you credibility and possibly more.

Be accurate because false reports carry risk. Section 1114(2)(D)(iv) makes a person who procures a registrar action by a knowing and material misrepresentation liable for the registrant's damages. If you rely on copyright, 17 U.S.C. § 512(f) does the same for DMCA notices.

The other recipients

Mail provider. A big provider can kill the sending account within a short time. Send the raw headers. For a lookalike with a Google Workspace or Microsoft 365 mail setup, use the provider's abuse form rather than the customer support line.

Host. Point out the terms of service violation and, if the site copied your pages, attach a DMCA notice meeting § 512(c)(3). You can make a DMCA notice without a copyright registration. You will need one before suing for infringement under Fourth Estate Public Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296 (2019). See Filing a DMCA Takedown Notice: A Practical Checklist.

CDN. Use the provider's abuse form and ask it to identify the origin host and to forward your complaint. Expect a response saying it is not the host. Then use the origin information it provides.

Blocklists. Report to Google Safe Browsing and Microsoft's reporting tool, and to your email security vendor. These work whether or not the registrar acts, and they often help protect people who have already been sent the link.

Report to the FTC too. ReportFraud.ftc.gov takes impersonation reports, and 16 C.F.R. Part 461 gives the agency a direct rule to enforce, though it gives you no private claim.

ccTLD names

If the name ends in a country code, ICANN's contracts don't apply. Use the ccTLD manager's abuse process and dispute policy. The IANA root database identifies the manager. Some have adopted the UDRP or a variant. Others have registrars far less responsive to overseas complaints, so the host, mail, and blocklist routes do more work there.

Hours 24 to 72: escalate and widen

If the registrar stalls

ICANN doesn't define "prompt" in hours. Its advisory calls for attentiveness scaled to the harm, and any time examples it gives are illustrative. Use a simple ladder.

When (suggested, not a rule) Step
Hour 0 Registrar report sent. Log the confirmation of receipt, which § 3.18.1 requires.
Hour 24 Follow up, add any new evidence, and call if a number is published.
Hour 24 to 48 Report to the registry operator. Under Specification 6, Section 4 of the base Registry Agreement, it must at minimum refer the name with evidence to the registrar or act directly.
Business day 2 or 3 File with ICANN Contractual Compliance using the "Abuse/DNS Abuse (Registrar)" form. Attach your earlier report and the correspondence. Explain what the registrar failed to do.
Ongoing If law enforcement is involved, ask the agent to use the registrar's 24/7 authority channel, which § 3.18.3 requires to be reviewed within 24 hours.

An ICANN complaint won't be resolved in time to save this week's payment, but ICANN's published numbers show it matters: through 5 August 2026 it had opened more than 650 DNS abuse investigations and issued eight notices of breach. It's also useful in later litigation as evidence of notice. Be selective. ICANN has said too many complaints are invalid, and it needs the list of domains, the explanation of abuse, proof of the prior report, and the reason you think the response was inadequate.

Notify the insurer

Tell your broker today, and put it in writing within 72 hours even if you aren't sure what's covered. Tender under every potentially relevant form: crime, cyber, and any professional or errors and omissions policy. Policies have prompt-notice conditions and proof-of-loss deadlines, so read them, and calendar the dates. For a discussion of notice, see Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice.

The cases split, so don't let an adjuster's first phrasing define your claim.

Do not sign anything with your counterparty, such as a split of the loss, without considering the policy's consent and subrogation terms. In American Tooling, an agreement to share the loss with the vendor didn't defeat coverage, but your policy may treat it differently, and a release could impair the insurer's subrogation rights.

Worked hypothetical: the first 72 hours with money gone

Back to the Duluth controller. Here is what a good response looks like. Friday, 3:15: she calls the bank's wire room. The bank opens a case and sends a recall by 3:40, and asks for an indemnity letter, which the CFO signs at 4:30. At 3:50 she files with IC3. Her IT contractor exports the emails and runs DNS lookups by 4:30, and finds the lookalike has MX records at a large mail provider, no web server, and a creation date nine days earlier. At 5:00 the CFO calls the vendor's owner on his cell phone, and the vendor says it will check its mail and send written authorization to report. At 5:40 abuse reports go to the registrar and mail provider. At 6:30 the IT contractor finds no rules in her company's mailboxes, so the vendor's side begins to look like the source of the leak.

On Saturday morning, the mail provider disables the account. Saturday afternoon the vendor's IT finds a forwarding rule on a salesperson's mailbox, active for six weeks. Monday: the registrar suspends the domain; the receiving bank tells her bank it froze $61,000, with the rest moved Thursday to a second account in another state, which the IC3 team now has as a second hop. Tuesday: broker notice goes out. Counsel for each side agrees by phone to preserve evidence and to talk later.

Result: the fraud has stopped, and $61,000 might come back. The real dispute about the other $85,000 is just starting, and it will turn on red flags she saw, or didn't, and on the vendor's six-week-old rule.

Day three onward: UDRP, URS, or lawsuit

If the abuse report succeeded, should you do more? Often yes, but only as much as the facts justify. A suspended name can come back if the registrar's hold is released or the name expires and gets re-registered.

Compare the options

Factor URS UDRP ACPA in rem ACPA in personam with TRO
Reach New gTLDs and adopters such as .org; not .com or .net All gTLDs; adopting ccTLDs Registrar or registry in a U.S. district Defendants subject to jurisdiction, plus those bound under Rule 65(d)(2)
Mark needed Registered word mark in current use, or court- or statute-validated Registered or common-law Registered, or protected under § 1125(a) or (c) Distinctive at registration
Burden Clear and convincing; no genuine issue Preponderance-style balance Preponderance Likelihood of success at TRO; preponderance at merits
Time Lock in 24 hours of notice; response 14 days Lock and data in 2 business days; response 20 days; panel 14 days after appointment; 10 business days to implement Months, unless emergency order Days to first order, if ready
Remedy Suspension only Transfer or cancellation Transfer, forfeiture, cancellation All of that, plus damages, fees, and injunction
Out-of-pocket filing cost ICANN's range is $300 to $500 $1,500 at WIPO, 1 to 5 names, single panelist Federal filing fee, then counsel, publication Federal filing fee, then significant counsel time; often five figures to get through a TRO, more with a bond and investigators

For the broader choice, see Choosing the Right Domain Name Dispute Procedure: A Practical Guide and Domain Name Dispute Forum Selection Checklist: A Practical Checklist.

A decision tree

  1. Do you own a mark? If not, and you are the inbound victim, your main domain tools are abuse reports. Ask the true owner to pursue trademark remedies, or skip them. A real intrusion into your systems may still support a computer-crime suit. If you own an unregistered mark, assemble proof of acquired distinctiveness before doing anything else.
  2. Has abuse been stopped, and is it a one-off? If yes, and the name means little, you may stop there, keep monitoring, and calendar the expiry date. Many businesses go no further, and that's a reasonable decision.
  3. Is it likely to recur, or does the name itself have value or risk? File a UDRP. It gets the registrar's data, which may help law enforcement, and it takes the name out of play. Use WIPO section 3.4 and section 3.1.4 of the Overview 3.1, which recognize email-based fraud and phishing as bad faith even without a website.
  4. Is it a new gTLD with an exact or near-exact registered word mark, and are you happy with suspension? A URS is cheap and quick. The lock doesn't stop the mail, so don't rely on it alone.
  5. Is there a continuing campaign, many names, a stalling registrar, serious ongoing customer harm, or a defendant you can actually find? Consider federal court. Also do so if you need discovery tools, because the mail provider and registrar records can identify the people involved.

Worked hypothetical: a brand under attack with a thin mark

Suppose a hypothetical restaurant-supply company, Fennel & Oak, holds a federal registration for its name. Customers begin receiving invoices from fennelandoak-billing.shop. The name is a new gTLD, so a URS is available. The registrar suspends within a day of the report, but three days later fennel-oak-accounts.com appears at a different registrar, and customers are told to use it. The company files a URS for the .shop name for a few hundred dollars so the suspension sticks for the registration term, and a UDRP for the .com, which the URS can't reach, naming the same party based on the shared mail provider and template. It also asks both registrars to look at associated names. If a third wave comes, it has a record for a TRO.

Now take a hypothetical local contractor, call it Riverbend County Roofing, with no registration, a descriptive name, and a few years of use, whose customers get a fake deposit request from riverbendcounty-roofing.net. The abuse report remains available, since it doesn't require a trademark. A UDRP requires proof of common-law rights, such as sales, advertising, and press showing the name has come to identify this company, and the panel may be skeptical. An ACPA claim requires distinctiveness at the time of registration. The reports and customer warnings are the right tool for this company. It should file a trademark application when the crisis is over, recognizing that a descriptive name may need proof of secondary meaning or go on the Supplemental Register. The advice is different because the mark is different.

Filing the UDRP

The mechanics are well covered in How to File a UDRP Complaint for Domain Name Disputes and Filing a UDRP Domain Name Complaint: A Practical Checklist. For a fraud case, a few additions apply:

  • Name the proxy service as listed. When the registrar reveals the underlying data, the provider will give you a chance to amend. Under the UDRP Rules, the registrar has two business days to lock and disclose.
  • Attach the emails and headers, and redact bank details not needed for the panel. Explain why a domain with no website is in use.
  • Use the three elements in the order of the Policy, paragraph 4(a). Don't claim only that the fraud is bad. Show registration and use in bad faith, including the date the name appeared relative to the fraud.
  • Ask for transfer rather than cancellation. A canceled name can be re-registered. If you take it, turn on logging and treat any incoming mail as sensitive.

Going to court

Choose your defendant and forum. An in personam case with Does, plus claims under 15 U.S.C. § 1125(d) and § 1125(a), gives you damages and an injunction. The in rem path under § 1125(d)(2) is available only if you can't get personal jurisdiction or can't find the person after notice, and it must be brought where the registrar or other authority sits, per Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002). For .com, that makes Virginia a common choice, under Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002). Pleading templates are in the Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses.

Watch the freeze provision. Under § 1125(d)(2)(D)(i)(II), a registrar or registry that gets a stamped in rem complaint must not transfer, suspend, or modify the name during the action, except on court order. If the registrar is in the middle of acting on your report, wait until it acts, or file with a motion ready.

Add the right counts, and leave out the wrong ones. For a mark owner, Lanham Act counts are the foundation, and 15 U.S.C. § 1116(a) gives a presumption of irreparable harm on likely success, including for § 1125(d). A party with no mark in the imitated name isn't necessarily shut out if its systems were broken into: Microsoft's complaint in No. 1:21-cv-822 (E.D. Va.) pleaded computer-crime statutes plus trespass and conversion, not trademark, though you lose the presumption and must prove irreparable harm the ordinary way. Add § 1030 only if there was real unauthorized access and at least $5,000 in qualifying loss; see Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide. RICO under 18 U.S.C. § 1964(c) is possible but raises the pleading burden, under Rule 9(b). Add state claims such as California's Anti-Phishing Act, Cal. Bus. & Prof. Code § 22948.3, if the facts and forum fit.

Prepare the TRO papers. Under Rule 65(b)(1), you need specific facts in a verified complaint or declaration, and counsel's certification of notice efforts and why notice shouldn't be required. Courts take the ex parte limit seriously, and Granny Goose Foods, Inc. v. Brotherhood of Teamsters, 415 U.S. 423 (1974), describes why. You'll need:

  • A declaration from a business witness on the mark, the harm, and how customers or staff were deceived.
  • A declaration from a technical witness on the domains, DNS, and why notice would allow the fraudster to move the infrastructure.
  • A declaration from counsel for the Rule 65(b)(1)(B) certification.
  • A proposed order listing every domain, directing the registrant to stop, and directing the named registry and registrars to disable or transfer. Courts have approved similar language in Microsoft's cases, such as No. 1:21-cv-822 (E.D. Va.). Also include limited early discovery under Rule 26(d)(1) and alternative service under Rule 4(f)(3).
  • A bond proposal under Rule 65(c), with a reason it can be modest.

Delay undercuts every word of it. See Winning or Opposing a Trademark Preliminary Injunction: A Practical Guide and Preliminary Injunction and TRO Application Checklist: A Practical Checklist.

Serve it on those who matter. An order served on a registrar, a registry, or a CDN gets you more than one sent to a fictitious registrant. Under Rule 65(d)(2)(C), it binds those in active concert who receive actual notice. Arista Records, LLC v. Tkach, 122 F. Supp. 3d 32 (S.D.N.Y. 2015), held a CDN bound where its services connected users to an evasive site after it had notice. Blockowicz v. Williams, 630 F.3d 563 (7th Cir. 2010), says mere continued inaction isn't enough, so craft the order and the notice with that case in mind. Foreign providers may not be bound in practice.

Service and identification. Use Columbia Insurance Co. v. seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999), for Doe discovery, with Rule 45 subpoenas. Ask for non-content records only, since 18 U.S.C. § 2702 bars content disclosure in response to civil subpoenas. For alternative service, Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002), is the classic. Check the Hague Service Convention if a known foreign address exists.

Expect a default. Most of these end with default judgment under Rule 55, a permanent injunction, and a transfer. Statutory damages of $1,000 to $100,000 per name under § 1117(d) are available, as Shields v. Zuccarini, 254 F.3d 476 (3d Cir. 2001), shows, but be honest in your budget about collectability. See Default and Default Judgment in Federal Court: Rules 55 and 60 and the Cost of Ignoring a Lawsuit.

The other sides of the dispute

If your counterparty says you still owe the money

Both of you are victims, and both of you have a lawyer's incentive to say the other should have caught it. Courts usually ask who was in the best position to prevent the fraud. Thomas v. Corbyn Restaurant Development Corp., No. D083655 (Cal. Ct. App. May 27, 2025), applied that test against the payor, and Yangtze Railroad Fasteners International USA Inc. v. Ohio Valley Trackwork Inc., 2026-Ohio-1518, did the same on a $40,000 balance, even assuming lax email practices on the seller's side.

If you paid the fraudster, build your position around the facts that favor you. Was the thread convincing? Was the email from the seller's true account? Was there any prior warning? Did the seller delay telling you of a compromise? Did the contract or course of dealing call for a method you followed? You may have a claim under Beau Townsend that the loss should be apportioned, and that summary judgment against you is improper.

If you never got paid, demand payment in writing, note the facts that made the fraud detectable, and don't rush past your own vulnerabilities. Was your mailbox the source? Did you know of the intrusion? Did you warn people? Bile turned on silence after notice. Do you still ship goods on credit? Consider a standstill.

Either way, talk early. A tolling and standstill agreement, an exchange of forensic findings under a confidentiality and common-interest arrangement, and mediation within 60 days are often worth more than litigating a fact-bound dispute against a customer you'd like to keep. Trading partners often split the loss. If there is a claim against an insurer, get its consent first.

In a real estate closing, the fight may be with a title or escrow agent. Hoffman v. Atlas Title Solutions, Ltd., 214 N.E.3d 1271 (Ohio Ct. App. 2023), reversed summary judgment for a title agency after a buyer lost $289,722.19 following emails from a Gmail address, finding triable issues about whether the agency's security was proper and whether the buyer should have spotted the fraud.

If you are thinking of suing the banks

Don't expect much. Studco reversed a bench verdict for the payor. 218 Broadway, LLC v. J.P. Morgan Chase Bank, N.A. (S.D.N.Y. Aug. 14, 2026), dismissed aiding-and-abetting and § 4-A-207 claims with prejudice, and GN Pro Group, LLC v. Well Done ASAP, LLC (N.D. Ill. Jan. 29, 2025), dismissed similar claims for lack of facts showing actual knowledge. Read your wire agreement first, because it probably contains the notice that lets your bank rely on the number. A different analysis applies if an intruder actually sent the order. Then the bank's security procedure is the question, as in Patco Construction Co. v. People's United Bank, 684 F.3d 197 (1st Cir. 2012), and Choice Escrow & Land Title, LLC v. BancorpSouth Bank, 754 F.3d 611 (8th Cir. 2014). Article 4A has its own limits on those claims, including a one-year outer limit in § 4A-505 on objecting to a debit, and your agreement may try to shorten them, so calendar them from your account statement.

If your domain is the one reported

It happens. A legitimate small business, a fan page, or a critic gets accused of being a fake. If your registrar tells you of a complaint, respond quickly with proof of who you are, how you use the name, and your business records. Point out that the site does not imitate the complainant. Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005), protects real criticism even with a misspelled domain name.

If your name is suspended under a registrar's policy, § 1114(2)(D)(v) allows you to sue, on notice to the mark owner, for a declaration that your use is lawful and for reactivation. Under (iv), you may recover from someone who made a knowing and material misrepresentation. After a UDRP loss, paragraph 4(k) gives you 10 business days to file suit and hold up the transfer, and Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617 (4th Cir. 2003), shows how that works.

If you are the registrar or host receiving the report

Publish the abuse contact, confirm receipt, and document your response, as § 3.18 requires. Distinguish malicious from compromised names, and write down your determination if you decline to act. A registrar that acts under a reasonable policy has the statutory protection in § 1114(2)(D)(ii). A registrar generally does not face a contributory cybersquatting claim under Petroliam Nasional Berhad v. GoDaddy.com, Inc., 737 F.3d 546 (9th Cir. 2013), but a registrar that is itself the registrant falls outside the safe harbor, as Verizon California Inc. v. OnlineNIC, Inc., 647 F. Supp. 2d 1110 (N.D. Cal. 2009), explains. Hosts should read Louis Vuitton Malletier, S.A. v. Akanoc Solutions, Inc., 658 F.3d 936 (9th Cir. 2011). Preserve records when asked, and disclose content only as the Stored Communications Act allows.

Common mistakes

  • Starting with the domain instead of the bank. The takedown can wait an hour. The wire can't.
  • Reporting before preserving. A successful report can delete your best exhibit.
  • Saving screenshots and throwing away the original email. The headers are the evidence, and a forward is not the original.
  • Calling the number in the suspicious email. Thomas faulted counsel for relying on numbers supplied inside the imposter's own thread instead of a source outside it. Use the number in the contract, the master file, or the public record.
  • Delegating the verification call without oversight. The Thomas court pointed out that the lawyer handed the follow-up to accounting.
  • Staying quiet after noticing an attempted diversion. Bile shows the bill for silence.
  • Assuming DMARC should have blocked it. Authentication passes on a domain the fraudster owns. Don't tell the insurer or the board otherwise.
  • Sending a cease-and-desist letter to a proxy address and waiting. Fraudsters don't read it, and it may warn them. A letter has a place in disputes with real businesses, covered in Drafting a Trademark Cease and Desist Letter, but not here.
  • Writing a legal brief for a trust and safety analyst. Short and specific gets acted on.
  • Reporting the wrong domain. For login.quillfreight.com.remit-portal-secure.net, the registrar of remit-portal-secure.net is your target.
  • Assuming you have a trademark claim on someone else's mark. Inbound victims generally need the owner's cooperation.
  • Filing in rem while a registrar is about to suspend. The freeze language can cost you days.
  • Resetting a password and calling it done. Revoke sessions, and check rules, delegates, and apps.
  • Blaming the clerk in writing. It hurts the witness, your defense, and the culture you need people to report in.
  • Missing the insurer's notice deadline. Tender promptly, even if unsure.
  • Calling the matter closed when the domain goes dark. Watch for the second wave, and calendar the name's expiry date.

The defensive program

The best time to do this is before anyone is reading this guide in a hurry. Most of it costs little.

Harden payment procedures

Treat a change of bank details as a controlled event. Require a call-back to a number on file, by someone other than the person who received the request, and record it. Require dual approval for new or changed payees, and consider a cooling-off period. Choice Escrow shows a customer that turned down dual control losing $440,000 when the bank's procedure was held to be commercially reasonable. Take any security options your bank offers, including positive pay and payee-name matching where available. Read your treasury agreement.

Put it in the contract

Consider terms like this, adapted by counsel for the deal:

Payment instructions. Payee's bank details are stated in Schedule 1. Payer shall not act on any change unless Payee's designated officer confirms it by telephone at the number in Schedule 1, or at another number the parties have agreed to in a signed amendment. Payment made in reliance on instructions not so confirmed does not discharge Payer's obligation. Each party shall notify the other within one business day after learning of unauthorized access to an email account used for communications under this Agreement or of an attempt to divert payments under this Agreement.

That allocates the risk the way courts tend to, and it replaces a fact-bound best-position trial with a simple question. A payee-friendly version might go further, and a payor-friendly version might carve out instructions from the payee's real compromised mailbox. For the broader program, see Vendor Cybersecurity Diligence Checklist: A Practical Checklist.

Lock your own email and domains

Require phishing-resistant MFA, alert on new forwarding rules, and disable external auto-forwarding by default. Set DMARC to quarantine or reject once your legitimate senders are aligned. It won't stop a lookalike, but it closes the exact-domain route, and it shows ordinary care. Put registry lock on the domains that matter, as discussed in Domain Name Security and Recovery Checklist: A Practical Checklist. If your real domain gets stolen, a different playbook applies: Recovering a Hijacked Domain Name: A Practical Guide.

Monitor

Run a permutation tool such as the open-source dnstwist on your main names periodically, and monitor Certificate Transparency logs for your marks. Commercial services do this and send alerts. Watch for new names that gain MX records, a sign they're ready to send and receive mail. Create a mailbox such as abuse@ and a page for reporting suspected fakes, and tell customers about them.

Register defensively, within reason

You cannot register every typo. Prioritize:

  1. Exact name in .com, .net, .org, and any TLD your customers would assume, plus country codes where you do business.
  2. Common misspellings and the hyphenated form of the exact name.
  3. Words a fraudster would add: billing, invoice, pay, payments, remit, accounts, secure, login, support.

Point those names to your site or set them to reject mail, with SPF and DMARC records showing that they send none. Buy with a corporate account, not an employee's account, and keep a single inventory with renewal dates. Then get a registration on the mark itself, since URS and easier UDRP filings depend on that. A clearance search through a tool such as marksy.us is a good first step. Sign up for the Trademark Clearinghouse if the new gTLD sunrise rounds matter to you.

Drill

Run a one-hour tabletop every year with finance, IT, and counsel. Hand them a copy of a lookalike email and a Friday afternoon. Check whether they know who calls the bank, whether they can reach the fraud desk after hours, where the indemnity authority lies, and how to export email with headers. Keep the phone tree on paper. The Lookalike Domain Response Checklist: A Practical Checklist is built to serve as the script.

This guide gives general information, and the right sequence for your company depends on its contracts, policies, and facts, so get specific advice before relying on any of it. If you'd like a second set of eyes during an incident or a tabletop, MC Law handles domain and fraud-response matters of this type.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits