If your registrar account has been hacked, secure the email inbox linked to it first, then phone the registrar and ask them to freeze the account and block outgoing transfers. After that, reset the password and two-factor setup, remove unknown users and API keys, and check every domain for changed nameservers, contacts and requested auth codes.
A compromised registrar account is worse than a single hijacked domain, because that is usually where every domain lives: the main site, the email domain, the old project names. The upside is that moving everything takes the attacker time. When a registrar account is hacked, you use exactly that time.
Registrar account hacked: immediate steps
- Inbox first. Every password reset at the registrar goes to the email address on file. As long as the attacker can read it, every change you make in the registrar account is worthless. New password, 2FA on, other sessions signed out, forwarding and filter rules checked.
- Phone the registrar. Don’t just open a ticket. Say it plainly: “My account is compromised; please block outgoing transfers and changes.” Get a ticket number and confirm the call by email.
- Take the account back. Reset the password, remove the two-factor setup and enrol it again. If the attacker added their own device as a second factor, they don’t need your password any more.
- Then clean up. The list follows.
If you can’t log in at all because the email and password have both been changed, the only route is support with proof of identity. Have invoices, your customer number and earlier correspondence ready.
What to check inside the account
Patient attackers make themselves at home. Go through each item:
| Area | What to look for |
|---|---|
| Users and sub-accounts | Extra users with admin or technical rights |
| API keys and tokens | New keys or new IP allow-list entries |
| Account email | Changed notification address |
| 2FA devices | Unknown authenticator or security-key entries |
| Payment methods | New cards, often used for purchases on your bill |
| Nameservers per domain | Switched to unfamiliar DNS providers |
| Transfer status and auth codes | Codes requested, transfer locks removed |
| Registrant and admin contacts | Changed names or email addresses |
Many registrars keep an activity log with date, time and IP address. Export it or take screenshots. It is your best evidence for the registrar, the police and possibly an insurer.
Stopping transfers in progress
The real damage happens when a domain leaves your account. How long you have depends on the extension.
gTLDs such as .com, .net, .org. ICANN’s Transfer Policy gives the losing registrar a window to deny a transfer, for instance on evidence of fraud. If you received an email with a link to reject a pending transfer, use it now. A domain whose lock was removed can also be locked again from your side as soon as you’re back in.
Country-code domains. Rules vary. Some registries move a domain as soon as the new registrar presents a valid code, with no window to object. The most useful thing your registrar can do is invalidate any auth code that was generated.
If the domain is already gone, the next steps are in domain hijacked.
How registrar accounts usually fall
After incidents like this you almost always find one of three causes. A password used somewhere else that turned up in a breach. A phishing email dressed up as a renewal notice (“your domain expires today, confirm now”). Or an inbox without two-factor protection that the reset went through.
The second is especially common, because domain owners regularly receive genuine emails like that. Registries and registrars warn about fake verification and renewal emails for this reason. How to check sender domains is covered in spot a phishing domain.
Hardening the account afterwards
A few measures make a repeat much less likely:
- Security key or passkey instead of SMS. SMS codes can be intercepted through SIM swapping. Details in 2FA for domain accounts.
- A dedicated email address for the registrar account, with a different provider and not on any domain in that account.
- Transfer lock on every domain, plus a registry lock for the important ones. The difference is explained in registrar lock.
- API keys bound to IP addresses, and only as many as you actually use.
If you manage many domains, consider putting the critical ones in a separate account with stricter rules. If the everyday account falls, the main domain stays out of reach.
Stay or switch registrar?
An account takeover is rarely the registrar’s fault. It is still a good moment to check the basics: does it offer 2FA with an app or security key, an activity log, DNSSEC and a reachable abuse contact?
betadomain offers DNSSEC and a domain API with your own keys, and renewals cost the same as registration. If you do want to move, wait until the old account is fully under your control again. A transfer in the middle of an incident only adds confusion.
Afterwards, check whether the main variants of your brand are registered. A lookup for your name across extensions takes seconds.
Step by step
- Secure the inboxReset the password and 2FA on the email account linked to the registrar and delete forwarding rules.
- Call the registrarReport the incident by phone and in writing and ask for transfers and changes to be blocked.
- Regain accessReset the password, re-enrol 2FA, end all sessions and generate new recovery codes.
- Remove foreign accessDelete unknown sub-accounts, API keys, IP allow-list entries and payment methods.
- Check every domainReview nameservers, DNS records, contacts, transfer lock and requested auth codes for each domain.
- Protect dependent accountsChange passwords on services that send email to addresses on the affected domains.
Found your domain? You can check and register it directly at check your domain – yearly price from €2.99.
FAQ
I got an email saying my auth code was requested. What does that mean?
The auth code, also called EPP or transfer code, is the password for moving a domain to another registrar. If someone else requested it, your account is either compromised or being probed. Change the password now and ask the registrar to invalidate the code and refuse any transfer.
Can a domain transfer be stopped once it has started?
For .com and other gTLDs, ICANN's Transfer Policy gives the losing registrar a window in which a transfer can be denied, for example for evidence of fraud. Many registrars email the registrant during that window with a link to reject it. The faster you act, the better your chances.
Do I need to open a new registrar account?
Rarely. Replacing every way in is usually enough: password, 2FA devices, recovery codes, API keys and sub-accounts. A fresh account only makes sense if the registrar can't reliably clean up the old one.
What if my registrar doesn't respond?
Keep a written record of every attempt. For gTLD domains you can file a complaint with ICANN Contractual Compliance if a registrar ignores its obligations. Meanwhile, protect the accounts that depend on the domain's email so a hijack does less damage.