Namecheap Handed an Account to a Stranger on Nothing but a Phone Request

A Hacker News user going by the handle Thrashed described an incident he himself is hard-pressed to even call social engineering — it was that simple. For thirteen years he had been a customer of the registrar Namecheap and, among other things, paid for a .com domain belonging to a student club at his former college. The domain was registered in his name, at his address and phone number — he simply kept renewing it so squatters wouldn't grab the address whenever the club's leadership changed hands.

How it happened

The club's new leader wanted to change the DNS but didn't know whom to ask. Having figured out that the domain was hosted at Namecheap, he initiated a password reset by entering the domain name. The owner received the reset email and immediately opened a support ticket: “I didn't request this.” They called him back, confirmed that he had indeed created the ticket, and sent a canned reply with advice like “check your antivirus.”

But the persistent new club leader also called support. He convinced the agent that the domain — registered under someone else's name and address — actually belonged to his club, and Namecheap, without a single check, changed the account password and the email address tied to it. A polite request was all it took.

Meanwhile, the two parties did find each other after all and amicably agreed to transfer the domain — the author had no objection to handing it over to the club himself. But, as he stresses, Namecheap knew nothing about any of this: to the registrar, this was the personal account of an unrelated stranger.

The irony is that they could have checked

The asymmetry is telling: to confirm the owner's own ticket, Namecheap didn't hesitate to call him. Yet when a complete stranger declared “I really want access to this account,” they didn't verify anything at all. And the author had both WHOIS privacy and two-factor authentication enabled — but a reset through support bypasses 2FA, and Namecheap lets you initiate a password reset with a username, an email, or just the domain name.

The author calls this not social engineering but a flat-out vulnerability, and reports that he has already moved his ten most important domains off Namecheap.

The community's reaction

The discussion quickly turned into a list of alternatives — the most frequently recommended being Porkbun, Cloudflare (registration at cost, but with mandatory use of their DNS), Dynadot and NearlyFreeSpeech. Many tie the decline in service to the recent change of ownership: in the fall of 2025, the fund CVC Capital Partners acquired a controlling stake in Namecheap, valuing the company at $1.5 billion, and the previous CEO stepped down in December. That said, some participants reasonably point out that stories like this about Namecheap had surfaced before, too — long before the arrival of private equity.

Source: Hacker News