I’ve heard this stuff about someone being able to transfer a domain without your approval before on this board. And being the holder of a few domains I was curious about this. So I did a little research…
Basically this isn’t true. The Gaining registrar is required by ICANN regulations to get approval from either the administrative contact or the Technical Contact of the domain name to initiate the transfer. The gaining registrar is also required to fill out what ICANN calls a Form of Authorization (FOA) then they must keep this form along with the communication they received from the domain name holder. The loosing registrar may request this form on their own to verify the transfer, or on your behalf – and they are required to present it. If the gaining registrar does not present this form that your registrar may deny the transfer or re-transfer the domain if the process has already been completed.
The gaining registrar must contact you either through the E-mail address listed in the domain contact information, or through the mail service. However if they do it through the mail you must present a notarized statement, drivers license, passport, or birth certificate showing that you are indeed the Administrative contact or Technical Contact. They may accept confirmation from any identity that has access to the E-mail address on file for the domain.
The loosing registrar is not allowed to deny the transfer request solely because you didn’t reply to an E-mail they sent - However they can deny the request if you tell them to, if the domain is in “Lock Status”, if the have evidence of fraud, court order, … or if it’s within the first 60 days of a domain being registered.
So yeah, there is space here for a registrar to get into fraud and transfer your domain with out your approval. But if they do you just contact your registrar and tell them what happened. They will then request the FOA from the gaining registrar. If they fail to produce that document then your registrar may take it back on your behalf. (There’s not a lot you can do personally, you have to rely on an ICANN accredited registrar)
But honestly why would a registrar try and take a domain name? When you notice it you can get it back, and if it was truly a fraud situation the company is likely to loose its accreditation with ICANN. But if you are worried just write DH support and ask them to put your domain into lock status – they DH will deny any transfer requests and the domain can not be moved without you first removing the lock.
Here are my sources: