Registrant transfer without an email?

[HariSeldon]

I released a domain of mine to another Tag Holder (i.e. a Registrar transfer) and somehow they've also had the Registrant details changed without me getting or accepting any transfer email from Nominet... how did they do that?

(It's all above board, the plan was to do the Registrant transfer too, I just can't work out how they got the Registrant details changed without involving me.)

 

[wb]

Probably edited the registrant administrative contact on the domain using the registrar domain manager and initiated a transfer to themself.

 

[HariSeldon]

wb, that was my first thought but to do that they'd need to also change my password (i.e. password reset) wouldn't they?

 

[wb]

Nope, as a registrar you are able to edit the administrative contact details for domains on your tag (i.e. the email address which will be associated with managing ownership of the domain).

If they edited this to their own address and then logged in to their account, they would see the domain there and be able to initiate the transfer without needing you. I think this is the only way which a registrant transfer could have been done.

 

[HariSeldon]

Gotcha, thanks, I think I get it now. So they changed my account admin contact to their email, processed transfer and then changed the admin contact back to my original email address. Sneaky!