07/13/2026
A web designer told me today that he has "won UDRP cases" because his clients sign an agreement letting him keep their domain name until they pay him.
I checked. Here's what I found — and why it matters to every business owner who has ever hired someone to build their website.
The setup is common. A business hires a developer. The developer registers the company's domain — the exact-match domain built around the business's own name — and is listed as the registrant. Later, there's a dispute over money. The developer responds by seizing the domain, moving it into an account the business can't reach, and refusing to release it until a demand is paid.
The belief behind this practice is that a signed "pay me or I keep the domain" clause makes it legitimate. It does not.
I searched the published UDRP decisions from WIPO and the Forum, the two providers that decide these cases in the United States. I could not find a single decision in which a developer who held a client's domain hostage over nonpayment actually won on that theory. Not one.
The precedent runs the other way, consistently:
In Alaska Health Fair v. Jacobson, a developer held a client's domain over an unpaid invoice. The panel ordered it returned, ruling that using a client's domain as leverage is bad-faith use — no matter how he first came to control it.
In DSPT International v. Nahum, the Ninth Circuit upheld a roughly $152,000 judgment against a developer who did the same thing, holding that "using a domain name to get leverage in a business dispute" violates the Anticybersquatting Consumer Protection Act.
And Kremen v. Cohen established that a domain name is property — which means taking one that isn't yours starts to look a great deal like theft.
The key is separating two questions that hostage-takers love to blur. Whether money is owed is a contract question, resolved with invoices and, if necessary, a courtroom. Who owns the domain is a separate question, answered by the WHOIS record and its history. A real debt never creates a right to seize someone else's domain.
There is also a criminal dimension. Transferring or changing the registrant of a domain without authorization can implicate the Computer Fraud and Abuse Act, federal wire fraud statutes, and state theft and extortion laws. That is why a police report is a legitimate step, not an empty threat.
I wrote the full breakdown — the specific decisions, the relevant law, a prevention checklist for business owners, and exactly what to do if your domain is being held hostage — on my blog:
https://www.billhartzer.com/domain-names/when-developer-holds-domain-hostage/
