Almost every week a client sends us a screenshot and asks: is this real? Usually it's an email that looks like it comes from IONOS. Sometimes it's an unpaid invoice, sometimes a failed direct debit, sometimes the domain is supposedly about to be deleted within 24 hours. The answer is almost always the same: no, it's a scam. Because we get this question so often, we want to write down once and in detail how to recognise these emails and how best to deal with them.
IONOS is one of the largest providers of domains, hosting and mailboxes in Germany. A huge number of small businesses, freelancers and associations host their website or at least their email address there. For scammers the maths is simple: send thousands of emails with an IONOS logo and you're bound to reach plenty of people who really are customers.
On top of that, a domain is incredibly important for most businesses. The threat that it will be switched off or that emails will stop arriving creates pressure immediately. And that pressure is exactly the tool these emails work with.
One thing matters to us here: it doesn't mean that data was stolen from IONOS. In the vast majority of cases the senders are simply guessing. They send the same email to huge lists of addresses and hope for a few hits.
The wording changes all the time, but the basic patterns stay surprisingly similar. These variants keep landing with our clients:
The goal is always one of two things. Either you're supposed to type your login details into a copied sign in page, or you're supposed to transfer money or enter card or bank details. Sometimes both, one after the other.
If we could only give one tip, it would be this one. Genuine emails from IONOS about your contract, such as invoices, reminders or notices about domains, usually include your customer number. The fakes either have none at all, a made up one, or simply your email address where the number should be.
You'll find your real customer number when you sign in to IONOS yourself. It's shown in the customer area and on every previous invoice. It's best to keep it somewhere you can find it quickly, then comparing takes seconds.
To be honest about it: a matching customer number is a good sign, but not proof. If scammers have got hold of the number somehow, for example from a hacked mailbox, they can use it too. A missing or wrong number, on the other hand, is a pretty reliable sign that something is off.
Almost every fake email has a big, eye catching button. Pay now, confirm account, renew domain. What the button says doesn't matter. What counts is the address behind it, and you can check that without clicking.
And if you do end up on a page: look at the browser's address bar before typing anything. A copied sign in page can look deceptively real, but it can't fake its address.
The display name above an email can be anything. It can say IONOS, IONOS Customer Service or even IONOS Billing, and it proves nothing. So tap or click on the name until the full email address appears. If the email comes from an address that doesn't end in ionos.de or ionos.com, you can delete it.
Unfortunately that doesn't work the other way round. Sender addresses can be forged, and not every mailbox catches that reliably. That's why the sender is one clue among several and never the only argument.
Other things we notice in fakes again and again:
To be fair about that list: AI is making these texts noticeably better right now. Spelling mistakes used to be a good giveaway, today many fakes are linguistically clean. That makes the technical checks all the more important: customer number, link and sender.
Some fake invoices don't come with a link but with an attachment. There's a simple rule here: don't open attachments from emails you're not sure about. ZIP archives, files ending in html or htm and documents that ask you to enable macros or content after opening are especially risky.
A PDF isn't automatically harmless either. Often it just contains another big button linking to a fake page. Checking the address works there exactly as it does in the email.
All the tips above help you recognise fakes. The one habit that really protects you is much simpler, though: for emails about invoices, payments or accounts, as a rule, don't click the link in the email.
Instead, open your browser yourself, type ionos.de or use a bookmark, and sign in there. If there really is an unpaid invoice or a problem with your domain, you'll see it in the customer area. If there's nothing there, the email was fake. It's that simple, and it works the same way with every provider, your bank and every online shop.
In our office we've made this a fixed rule. No payment and no login via a link from an email, no matter how real it looks. It costs maybe thirty seconds each time and has saved us trouble more than once.
Once you've identified an email as fake, deleting it is basically enough. If you want to help others, you can do a little more:
It happens, and it happens to people who actually know their way around. The only thing that matters now is to act quickly rather than waiting out of embarrassment. Depending on what you entered, these are the next steps:
Keep the fake email for this instead of deleting it. For the bank and the police it's important evidence.
You can't prevent these emails entirely. But you can make sure a mistake doesn't immediately turn into a problem:
We're seeing one case more and more often: the fake appears to come from your own address, say from info@yourdomain.com to info@yourdomain.com. That feels alarming, but usually it doesn't mean your mailbox has been hacked. The senders simply enter your address as the sender.
Three technical entries in your domain settings help against this, called SPF, DKIM and DMARC. They define which servers may send email on behalf of your domain and tell other mailboxes what to do with forgeries. With many domains we look at, at least one of them is missing or set up in a way that has no effect.
That protects not only you but also your customers. Because if your domain can be forged, fake invoices in your name will sooner or later land with them too.
Fake emails in the name of IONOS aren't going away, and they're getting better rather than worse. With a few simple checks you'll spot most of them straight away, though: compare the customer number, check the link, look at the sender. And if you're unsure, just go directly to your customer area instead of via the email.
If you've received a suspicious email and aren't sure, feel free to send us a screenshot. We'll tell you honestly whether it's genuine. And if you want to know whether your own domain is protected against forgery, we'll look at SPF, DKIM and DMARC together with you and set them up properly if needed.
Two severe flaws in PHP are leaving websites around the world open to attack right now, WordPress sites first and foremost. Why most of the sites we build aren't affected, and how we can help if your website runs on PHP.
Read more
The llms.txt is popping up everywhere right now, often together with big promises. We created one ourselves and explain what's behind it, what it can do and where you shouldn't expect too much.
Read more
Since August 2026, the transparency obligations of the EU AI Act apply. Sounds like legal clauses and panic, but for most businesses it's very manageable. We explain what matters.
Read more