Enshittification and PE sellouts are great for DNS providers because migrating it can be a real pain sometimes and carry a high risk if something goes wrong. It's why so many of them are chains of "Buy through Company N! We used to work for Company N-1 before they sold out!"
This kind of story makes me wonder how popular a domain I can take control of simply by being convincing over the phone.
I can't even log in to most web sites anymore without doing a side-trip to my E-mail inbox, "for enhanced security," but these clowns let you just take a domain by asking nicely!
I've been a long, long term customer of Namecheap as well.
Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost.
The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset.
This clearly isn't an answer for NC's customer support personnel and company policies.
But I've been a happy customer for many years and I discourage others from immediately reading other comments and rushing to jump to other registrars without doing your due dilligence.
Remember that in any situation, the people most likely to leave negative comments and reviews are the people that have had genuine bad experiences or feel like they've been slighted, even if unwarranted.
How is domain privacy relevant here? That only hides your email from public records. What if the attacker already knows it (as they did in this case)? Email address is quite literally something you are meant to share publicly. It is not a password.
I've had the exact same issue with a small local registrar.
Had an account where I managed multiple clients. One of the clients had their "IT guy" contact the registrar for a DNS change. The registrar promptly gave the guy full access to my account, changing the password and locking me out in the process.
As soon as I regained access I moved everything off there.
Humans are the weakest link, wouldn't be shocked if it's some underpaid off shore call centre or whatever. That's not a vulnerability though, that is social engineering, the attack vector was a human and the exploit was a form of identity theft.
People are (rightfully) concerned about superintelligent AI but social engineering continues to be by far the biggest attack vector for digital infrastructure. And it’s being made worse by companies continuously cutting costs in areas like support.
The call center employee making third world minimum wage doesn’t give a shit who the real owner of the domain is. They want to end the call quickly and get 5 stars from the customer on the feedback form.
I have made it a point to move off services that force SMS-based 2fa for this exact reason. Recently even changed banks because of this.
Notably, they have been bought out by private equity.
> September 2025, CVC Capital Partners acquired a majority stake in Namecheap for an undisclosed amount, valuing the company at $1.5 billion.[3][4] Kirkendall stepped down as CEO on December 16, 2025
But prior to this they have had many incidents. Switched all domains to porkbun a few years ago
Just a few weeks ago I moved from Namecheap to Porkbun. That's not an advertisement - I simply Googled popular registrars. But it is an indictment of Namecheap. They are going the way of GoDaddy. Please move away from them immediately. They are shifting to short-term strategies (high prices, immoral data practices, etc).
Is it time to change registrars already? I fled Gandi a while ago because of private equity fuckery. And now I need to go somewhere else. Who won't adopt enshitification-as-a-business-plan for a few years?
No wonder people are leaving tech to go be goat farmers.
namecheap has had a mixed reputation for several years now. when i took over responsibility for a domain registered on namecheap the first thing i did was move it off there (to gandi, because that was before gandi was sold) because i heard some problematic stories about namecheap. it baffles me everytime i see namecheap recommended.
Gandi got EXPENSIVE which is unfortunate because they often had TLDs no one else had first. I'm still with them for a single domain. Once Cloudflare supports .se, I'm outta there!
> Who won't adopt enshitification-as-a-business-plan for a few years?
I don't have a crystal ball, but NearlyFreeSpeech was recommended to me in 2010 and I've been using it since 2012. I don't think it's changed at all in that time.
CloudFlare has their plusses and minuses, but they do offer domain registration at cost, for example $10.46/year for .com (every year, not one of those deals for the first year then more expensive down the line).
Yep. I've been with Namecheap for a similar length of time. This week they sent me an email saying I had to update my namecheap profile information or they would close my account in 24 hours.
They locked my account so I couldn't log in. To be clear, my whois information was fullly legally compliant, and I was happy to also update my namecheap profile, but when I sent them an email they didn't get back to with an response email until there was just an hour left.
Things had been going down hill slowly and lots of my peers have already moved on to porkbun, etc, but I think now things are going downhill quite fast. I did manage to save my account (and so domains) but now I will be moving to a new registrar.
Namecheap has been owned by a private equity firm for several months now.
It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.
...seriously? Where do I jump ship to now?
Porkbun. Yes, Cloudflare Domains exists but let's support the small guys.
Enshittification and PE sellouts are great for DNS providers because migrating it can be a real pain sometimes and carry a high risk if something goes wrong. It's why so many of them are chains of "Buy through Company N! We used to work for Company N-1 before they sold out!"
This kind of story makes me wonder how popular a domain I can take control of simply by being convincing over the phone.
I can't even log in to most web sites anymore without doing a side-trip to my E-mail inbox, "for enhanced security," but these clowns let you just take a domain by asking nicely!
I've been a long, long term customer of Namecheap as well.
Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost.
The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset.
This clearly isn't an answer for NC's customer support personnel and company policies.
But I've been a happy customer for many years and I discourage others from immediately reading other comments and rushing to jump to other registrars without doing your due dilligence.
Remember that in any situation, the people most likely to leave negative comments and reviews are the people that have had genuine bad experiences or feel like they've been slighted, even if unwarranted.
How is domain privacy relevant here? That only hides your email from public records. What if the attacker already knows it (as they did in this case)? Email address is quite literally something you are meant to share publicly. It is not a password.
I did have domain privacy enabled. NC allows people to initiate a password reset via username, email address, or domain name.
I was a happy customer right up until this incident. And I certainly agree that due diligence is a must for something as critical as a registrar.
Glad you posted your experience. I'll definitely be keeping my eye out for shenanigans on my own domains.
How will that help you prevent the transfer? The OP also "kept his eye out"
Did you have 2FA enabled too?
I've had the exact same issue with a small local registrar.
Had an account where I managed multiple clients. One of the clients had their "IT guy" contact the registrar for a DNS change. The registrar promptly gave the guy full access to my account, changing the password and locking me out in the process.
As soon as I regained access I moved everything off there.
Don’t be shy. Tell us the name.
This is unacceptable and such companies should change their policy or be out of business.
Well, they didn't call it NameCompetent, did they?
They're not even cheap these days, either. I'm still with them as a matter of laziness but I really need to migrate out.
Cloudflare offers domain registration/renewal with no markup if you're looking for an option. I moved to them after AWS increased fees.
Humans are the weakest link, wouldn't be shocked if it's some underpaid off shore call centre or whatever. That's not a vulnerability though, that is social engineering, the attack vector was a human and the exploit was a form of identity theft.
Scrolling through the current comments.
In the meantime, been with NameCheap for I don't recall how long with no issues whatsoever.
People are (rightfully) concerned about superintelligent AI but social engineering continues to be by far the biggest attack vector for digital infrastructure. And it’s being made worse by companies continuously cutting costs in areas like support.
The call center employee making third world minimum wage doesn’t give a shit who the real owner of the domain is. They want to end the call quickly and get 5 stars from the customer on the feedback form.
I have made it a point to move off services that force SMS-based 2fa for this exact reason. Recently even changed banks because of this.
Notably, they have been bought out by private equity.
> September 2025, CVC Capital Partners acquired a majority stake in Namecheap for an undisclosed amount, valuing the company at $1.5 billion.[3][4] Kirkendall stepped down as CEO on December 16, 2025
But prior to this they have had many incidents. Switched all domains to porkbun a few years ago
Just a few weeks ago I moved from Namecheap to Porkbun. That's not an advertisement - I simply Googled popular registrars. But it is an indictment of Namecheap. They are going the way of GoDaddy. Please move away from them immediately. They are shifting to short-term strategies (high prices, immoral data practices, etc).
Is it time to change registrars already? I fled Gandi a while ago because of private equity fuckery. And now I need to go somewhere else. Who won't adopt enshitification-as-a-business-plan for a few years?
No wonder people are leaving tech to go be goat farmers.
namecheap has had a mixed reputation for several years now. when i took over responsibility for a domain registered on namecheap the first thing i did was move it off there (to gandi, because that was before gandi was sold) because i heard some problematic stories about namecheap. it baffles me everytime i see namecheap recommended.
Gandi got EXPENSIVE which is unfortunate because they often had TLDs no one else had first. I'm still with them for a single domain. Once Cloudflare supports .se, I'm outta there!
> Who won't adopt enshitification-as-a-business-plan for a few years?
I don't have a crystal ball, but NearlyFreeSpeech was recommended to me in 2010 and I've been using it since 2012. I don't think it's changed at all in that time.
https://www.nearlyfreespeech.net/services/domains
https://www.nearlyfreespeech.net/services/respect
I am also looking for something that will last for a good while.
CloudFlare has their plusses and minuses, but they do offer domain registration at cost, for example $10.46/year for .com (every year, not one of those deals for the first year then more expensive down the line).
The problem is that they then force you to use them as a DNS host as well.
Ah namecheap. Stories about them make it to HN quite regularly: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
Yep. I've been with Namecheap for a similar length of time. This week they sent me an email saying I had to update my namecheap profile information or they would close my account in 24 hours.
They locked my account so I couldn't log in. To be clear, my whois information was fullly legally compliant, and I was happy to also update my namecheap profile, but when I sent them an email they didn't get back to with an response email until there was just an hour left.
Things had been going down hill slowly and lots of my peers have already moved on to porkbun, etc, but I think now things are going downhill quite fast. I did manage to save my account (and so domains) but now I will be moving to a new registrar.
That sounds more like a phishing attempt than anything a real company should send.
I think I have one domain left with them. I haven't received anything yet, but it's a good reminder to move on.
I got that same email but skimmed it. I guess I need to double check and then move.
24 hours is a ridiculously short warning period, especially when they lock you out from meeting their demands yourself.
What if their email got caught in a spam filter? What if you only check that inbox a few times a week or after business hours?
I'll be moving my personal domains after doing some research.
> saying I had to update my namecheap profile information or they would close my account in 24 hours.
Did they mention what prompted this?
Are you aware of anything?