Completely understandable reaction. The email looks oddly official, contains a wall of personal data, and nobody remembers signing up for anything called "ICANN."
The email is sent by Shopify on behalf of ICANN — the Internet Corporation for Assigned Names and Numbers, the international body that oversees how domain names work globally. ICANN requires every domain registrar (including Shopify, GoDaddy, Namecheap, and others) to periodically send registrants a copy of their WHOIS data and ask them to confirm it's accurate.
The email itself requires no action if your details are correct. It's a formality, not a bill or a threat.
Here's a mock-up of the style of email our client received, with all personal details anonymised:
Dear Customer,
ICANN, the organization responsible for the stability of the Internet, requires that each domain name registrant be given the opportunity to correct any inaccurate contact data (WHOIS data) associated with a domain name registration. Our records for your domain are as follows:
If any of the information above is inaccurate, you should correct it. If all of the information above is accurate, you do not needto take any action.
To review and update your WHOIS contact information, please log into our management interface.
Thank you for your attention.
Shopify Inc.
This is the part that catches people off guard. When you registered your domain, that information was automatically added to the global WHOIS database, a public directory that anyone can query. Name, address, phone number, email. All of it. Historically this was required to ensure domains weren't registered anonymously for illegal purposes.
Anyone can look up who owns a domain name, it takes about ten seconds and zero technical skills. They can then those details to stage a pfishing attack.
Sometimes your details were made private when you signed up. To check if that is the case, go to https://www.whois.com/whois/ and search for your domain. If you can't see anything that you'd like to keep private there, happy days!
If you are seeing things like your Name, email, phone number, address ......
WHOIS Privacy (sometimes called "domain privacy" or "proxy registration") replaces your real personal details in the public database with Shopify's generic proxy contact. Anyone searching the WHOIS database for your domain will see Shopify's address, not yours.
While you're in there, it's worth confirming your domain's renewal date. Domains that lapse become available for anyone to register, which can be catastrophic for a business. The WHOIS confirmation email will always list it clearly.
Most registrars send renewal reminders automatically, but it never hurts to have your own reminder set a month beforehand. A common scam is to send you a bogus reminder and payment link - make sure you are only paying your domain!
If you're ever unsure whether an email about your domain is genuine, forward it to us before clicking anything. We'd rather take five minutes to check than have you deal with a compromised account.
Scammers are impersonating Shopify experts, including us, to trick store owners with fake compliance warnings. Here's what the email looks like and how to spot it immediately.
