Namecheap handed over a domain account to a stranger who just asked nicely

A 13-year Namecheap customer describes losing control of a domain registered in his name after an incoming leader of a college club — the domain’s real-world user — called support and talked his way in. The customer had already flagged the suspicious activity: when the club leader triggered a password reset, he opened a ticket disowning it, and Namecheap even phoned him to confirm he’d filed it. Yet when the third party later called and insisted the account was really his, support changed the password and swapped the registered email address with no verification of any kind. The two parties happened to sort things out privately, but Namecheap had no way of knowing that.

The author argues this barely qualifies as social engineering — it’s a straightforward account-takeover vulnerability, since the registrar demonstrably could reach the real owner by phone but never bothered to when someone else asked for control. He says he has already migrated a dozen critical domains off the platform. Commenters note Namecheap’s lax posture predates its recent acquisition by a private equity firm, though several expect the situation to worsen under PE ownership.

The thread widens into a broader debate about how to pick a durable registrar. One camp favors large firms where domains aren’t the profit center; others counter that non-core units get neglected or killed, citing Google Domains’ sale to Squarespace and Cloudflare’s registrar locking nameservers to its own. Suggestions include smaller privacy-focused shops like Porkbun, staying ready to jump when a provider degrades, and choosing a local registrar you could confront in person — with a recurring wish for a nonprofit registrar that would remove the need to keep migrating.