Namecheap handed account to stranger without owner verification, user warns

A 13-year Namecheap customer says the domain registrar transferred full control of his account to an unverified third party after that person simply called support and claimed ownership of the domain. The account holder had already alerted Namecheap via a support ticket that he had not initiated a password reset, yet the company changed both his password and associated email address without contacting him. Namecheap had previously demonstrated it could reach the legitimate owner by phone when verifying his support ticket, but applied no such check when the third party called in. The user notes the situation was ultimately resolved amicably, as the third party turned out to be a new leader of a college club whose domain the owner had been maintaining. In response, the account holder has moved over a dozen critical domains away from Namecheap, calling the incident a serious account-takeover vulnerability requiring only a persuasive phone call.