Namecheap Gave My Account to an Unverified Third Party Just Because They Asked

I’ve been a NameCheap customer for 13 years. I’ve also helped out an old college club paying for a .com they use (that is registered to me under my name, address, and phone number). During a recent leadership transition, the incoming club lead wanted to make changes to the DNS and didn’t know to contact me. They figured out the domain name was parked at NameCheap, so they initiated a password reset using the domain name. I got a password reset email and immediately filed a NameCheap support ticket saying “I did not initiate this”. They called me to verify I was the one who filed the ticket, and then followed up with a canned email with tips like check your anti-virus.

The incoming club leader was persistent though, and called NameCheap support. He convinced them the domain registered in my name and address really belonged to his club, and with no verification or validation whatsoever, NameCheap changed my password, and changed the email address associated with my account. All because someone simply asked nicely on a phone call.

Meanwhile in the background, someone advised the new club leader who I was and we were able to connect and get things transferred over. Ultimately I was happy to give them access or even ownership if they wanted (student club turnover being what it is, it’s likely a domain doesn’t get renewed and gets gobbled up by a squatter, which is why I was keeping it current for them).

But NameCheap had no way of knowing any of this. As far as NameCheap was aware, this was a personal account of mine. They demonstrated they were perfectly able to pick up a phone and call me (to verify my initial support ticket) but when someone calls them and says “but I really want access to that account” they don’t bother?

I’d hesitate to even call this social engineering. It’s clearly a massive vulnerability. I’ve already moved a dozen of my most critical domains out of NameCheap after seeing just how easy it is for a third party to completely take over a NameCheap account: just ask nicely.

172 points | by Thrashed 1 hour ago

15 comments

  • pilingual 28 minutes ago
    Namecheap has been owned by a private equity firm for several months now.

    It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

    • terribleperson 21 minutes ago
      ...seriously? Where do I jump ship to now?
      • joshuamcginnis 3 minutes ago
        I like https://www.dynadot.com/. Good prices and privately owned for 30+ years.
      • deadalus 9 minutes ago
        Porkbun. Yes, Cloudflare Domains exists but let's support the small guys.
        • cube00 2 minutes ago
          Given Cloudflare's reputation for shakedowns once you pass their invisible thresholds I wouldn't trust them with my domains.
      • kilroy123 4 minutes ago
        I moved all my from name cheap to porkbun years ago.
      • deejaaymac 1 minute ago
        Porkbun!
    • viccis 22 minutes ago
      Enshittification and PE sellouts are great for DNS providers because migrating it can be a real pain sometimes and carry a high risk if something goes wrong. It's why so many of them are chains of "Buy through Company N! We used to work for Company N-1 before they sold out!"
  • geuis 40 minutes ago
    I've been a long, long term customer of Namecheap as well.

    Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost.

    The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset.

    This clearly isn't an answer for NC's customer support personnel and company policies.

    But I've been a happy customer for many years and I discourage others from immediately reading other comments and rushing to jump to other registrars without doing your due dilligence.

    Remember that in any situation, the people most likely to leave negative comments and reviews are the people that have had genuine bad experiences or feel like they've been slighted, even if unwarranted.

    • paxys 27 minutes ago
      How is domain privacy relevant here? That only hides your email from public records. What if the attacker already knows it (as they did in this case)? Email address is quite literally something you are meant to share publicly. It is not a password.
      • vel0city 1 minute ago
        Registration info usually also includes a physical address and names.
    • Thrashed 36 minutes ago
      I did have domain privacy enabled. NC allows people to initiate a password reset via username, email address, or domain name.

      I was a happy customer right up until this incident. And I certainly agree that due diligence is a must for something as critical as a registrar.

      • blcArmadillo 18 minutes ago
        Did you have 2FA enabled too?
      • geuis 31 minutes ago
        Glad you posted your experience. I'll definitely be keeping my eye out for shenanigans on my own domains.
        • eviks 21 minutes ago
          How will that help you prevent the transfer? The OP also "kept his eye out"
  • richardchilders 7 minutes ago
    Namecheap forces users to log in to identify themselves. So far, OK.

    But then when one attempts to pay for a domain, after one has already provided all of one's credit card information to Namecheap ... Namecheap up and refers its customers to something called Link, which forces Namecheap's customers to create an account and become Link's customers - providing all that confidential credit card information, all over - leaving the customer wondering why Namecheap collected it and what they are going to do with it.

    Link forces you to authenticate via SMS so that they know where you are.

    This all happened less than 24 hours ago and I was already getting ready to put domain service shopping on my list of things to do but I'm glad to see I'm not the only one.

    I nominate Paul Vixie as a possible candidate for CTO or even CEO of a hypothetical nonprofit DNS domain service.

    More info: uggcf://fnynanir-ehalba.bet/ureovr.ugzy

  • ryandrake 8 minutes ago
    This kind of story makes me wonder what's the most popular/valuable domain I can take control of simply by being convincing over the phone. Sounds tempting!

    I can't even log in to most web sites anymore without doing a side-trip to my E-mail inbox, "for enhanced security," but these clowns let you just take a domain by asking nicely!

  • dalmo3 43 minutes ago
    I've had the exact same issue with a small local registrar.

    Had an account where I managed multiple clients. One of the clients had their "IT guy" contact the registrar for a DNS change. The registrar promptly gave the guy full access to my account, changing the password and locking me out in the process.

    As soon as I regained access I moved everything off there.

    • sixtyj 36 minutes ago
      Don’t be shy. Tell us the name.

      This is unacceptable and such companies should change their policy or be out of business.

  • addaon 45 minutes ago
    Well, they didn't call it NameCompetent, did they?
    • Retr0id 42 minutes ago
      They're not even cheap these days, either. I'm still with them as a matter of laziness but I really need to migrate out.
      • jolan 22 minutes ago
        Cloudflare offers domain registration/renewal with no markup if you're looking for an option. I moved to them after AWS increased fees.
  • hmokiguess 20 minutes ago
    Humans are the weakest link, wouldn't be shocked if it's some underpaid off shore call centre or whatever. That's not a vulnerability though, that is social engineering, the attack vector was a human and the exploit was a form of identity theft.
  • sandeepkd 4 minutes ago
    In the absence of actual details its hard to say what was considered for making this decision. If I have to take a wild guess then being able to demonstrate the control on the webserver hosting the content could have been one way to prove ownership over the domain.

    It can be called social engineering, however one can also put it in category of account recovery by verifying content control on the domain.

    The part where it gets hairy is if your credit card was associated with the account, thats probably a recipe for disaster?

  • assimpleaspossi 10 minutes ago
    Scrolling through the current comments.

    In the meantime, been with NameCheap for I don't recall how long with no issues whatsoever.

  • linsomniac 27 minutes ago
    CloudFlare has their plusses and minuses, but they do offer domain registration at cost, for example $10.46/year for .com (every year, not one of those deals for the first year then more expensive down the line).
    • sigio 21 minutes ago
      The problem is that they then force you to use them as a DNS host as well.
      • himata4113 1 minute ago
        You actually can use your own nameservers... if you pay for the business plan which is $2400/yr.
  • paxys 23 minutes ago
    People are (rightfully) concerned about superintelligent AI but social engineering continues to be by far the biggest attack vector for digital infrastructure. And it’s being made worse by companies continuously cutting costs in areas like support.

    The call center employee making third world minimum wage doesn’t give a shit who the real owner of the domain is. They want to end the call quickly and get 5 stars from the customer on the feedback form.

    I have made it a point to move off services that force SMS-based 2fa for this exact reason. Recently even changed banks because of this.

    • ethin 4 minutes ago
      Honestly I'm wayyy more concerned with social engineering attacks than some theoretically superintelligent AI. Social engineering is, IMO, the far worse of the too
  • happytoexplain 53 minutes ago
    Just a few weeks ago I moved from Namecheap to Porkbun. That's not an advertisement - I simply Googled popular registrars. But it is an indictment of Namecheap. They are going the way of GoDaddy. Please move away from them immediately. They are shifting to short-term strategies (high prices, immoral data practices, etc).
    • rickydroll 43 minutes ago
      Is it time to change registrars already? I fled Gandi a while ago because of private equity fuckery. And now I need to go somewhere else. Who won't adopt enshitification-as-a-business-plan for a few years?

      No wonder people are leaving tech to go be goat farmers.

      • em-bee 13 minutes ago
        namecheap has had a mixed reputation for several years now. when i took over responsibility for a domain registered on namecheap the first thing i did was move it off there (to gandi, because that was before gandi was sold) because i heard some problematic stories about namecheap. it baffles me everytime i see namecheap recommended.
      • NetOpWibby 26 minutes ago
        Gandi got EXPENSIVE which is unfortunate because they often had TLDs no one else had first. I'm still with them for a single domain. Once Cloudflare supports .se, I'm outta there!
      • js2 35 minutes ago
        > Who won't adopt enshitification-as-a-business-plan for a few years?

        I don't have a crystal ball, but NearlyFreeSpeech was recommended to me in 2010 and I've been using it since 2012. I don't think it's changed at all in that time.

        https://www.nearlyfreespeech.net/services/domains

        https://www.nearlyfreespeech.net/services/respect

      • chrismarlow9 35 minutes ago
        I am also looking for something that will last for a good while.
  • xyst 9 minutes ago
    Notably, they have been bought out by private equity.

    > September 2025, CVC Capital Partners acquired a majority stake in Namecheap for an undisclosed amount, valuing the company at $1.5 billion.[3][4] Kirkendall stepped down as CEO on December 16, 2025

    But prior to this they have had many incidents. Switched all domains to porkbun a few years ago

  • superkuh 1 hour ago
    Yep. I've been with Namecheap for a similar length of time. This week they sent me an email saying I had to update my namecheap profile information or they would close my account in 24 hours.

    They locked my account so I couldn't log in. To be clear, my whois information was fullly legally compliant, and I was happy to also update my namecheap profile, but when I sent them an email they didn't get back to with an response email until there was just an hour left.

    Things had been going down hill slowly and lots of my peers have already moved on to porkbun, etc, but I think now things are going downhill quite fast. I did manage to save my account (and so domains) but now I will be moving to a new registrar.

    • jddj 25 minutes ago
      That sounds more like a phishing attempt than anything a real company should send.

      I think I have one domain left with them. I haven't received anything yet, but it's a good reminder to move on.

    • ramgine 48 minutes ago
      I got that same email but skimmed it. I guess I need to double check and then move.
    • iAMkenough 47 minutes ago
      24 hours is a ridiculously short warning period, especially when they lock you out from meeting their demands yourself.

      What if their email got caught in a spam filter? What if you only check that inbox a few times a week or after business hours?

      I'll be moving my personal domains after doing some research.

    • DANmode 53 minutes ago
      > saying I had to update my namecheap profile information or they would close my account in 24 hours.

      Did they mention what prompted this?

      Are you aware of anything?

  • phendrenad2 33 minutes ago
    Ah namecheap. Stories about them make it to HN quite regularly: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...