PanicStation.org
UK USA
uk Technology & digital loss domain hijacking • stolen domain name • unauthorised domain transfer • domain transferred out • change of registrant • registrant details changed • whois changed unexpectedly • registrar account hacked • domain ownership changed • nameservers changed • dns records changed • auth code compromised • epp code leaked • domain lock problem • email takeover linked • website redirecting • business email at risk • phishing from my domain • uk domain .uk transfer issue • regain control of domain

What to do if…
your domain registrar shows a transfer or ownership change you did not request

Short answer

Treat this as urgent: contact your registrar’s security/abuse team immediately and ask them to lock the domain and your account and to stop or reverse any unauthorised transfer or change of registrant if possible.

Do not do these things

  • Don’t “wait to see if it fixes itself” or assume it’s a harmless admin update.
  • Don’t keep trying to log in over and over if you suspect compromise—stop after one attempt and switch to password reset + support escalation.
  • Don’t delete emails, support tickets, invoices, or registrar notifications related to the change.
  • Don’t pay unsolicited “domain recovery” messages or anyone who claims they can “release” your domain for a fee.
  • Don’t make lots of DNS/website changes while ownership is unclear (it can complicate recovery and evidence).

What to do now

  1. Open an urgent ticket and use any real-time support channel your registrar offers.

    • Say: “unauthorised transfer” and/or “unauthorised change of registrant.”
    • Ask them to confirm: what changed (registrar? registrant contact? nameservers? auth/EPP code?) and exactly when.

  2. Ask for immediate locks/holds the registrar can apply right now.

    • Request registrar lock on the domain (and any “transfer lock” options) plus an account-level lock if they offer it.
    • If you’re told the domain is already “in transfer,” ask what stop/cancel options exist and what evidence they need to act quickly.

  3. Secure the accounts attackers commonly use to take domains (start with email).

    • Change passwords for: the registrar account, the email inbox used for the domain contact, and any DNS/hosting provider accounts.
    • Turn on MFA everywhere you can.
    • In your email account, check for: forwarding rules, new mailbox delegates, and changes to recovery email/phone.

  4. Collect proof and a clean timeline (this helps your registrar/registry act).

    • Save screenshots/PDFs of: registrar alerts, account activity logs, WHOIS/registration details, invoices/receipts, and older registration/renewal confirmations.
    • Write down exact timestamps (UK time), ticket numbers, and who you spoke to.

  5. If it’s a .UK domain, ask about Nominet’s registry-level protections.

    • For .uk / .co.uk / .org.uk, your registrar can work with Nominet on registry status.
    • Ask specifically whether Nominet Domain Lock (a paid, registrar-provided service) is relevant once you regain control, and whether any registry-side action is needed now.

  6. Check for immediate harm: DNS and email routing changes.

    • Check whether nameservers changed and whether key DNS records changed (especially MX for email).
    • If you suspect phishing/impersonation, warn colleagues/customers through an alternate trusted channel and treat emails “from you” as untrusted until control is restored.

  7. Report as cyber crime/fraud if there’s money loss, extortion, or customer impact.

    • If you live in England, Wales or Northern Ireland, report via Report Fraud.
    • If you live in Scotland, report via Police Scotland (101 unless it’s an emergency).

What can wait

  • You do not need to decide today whether to sue, rebrand, or move registrars.
  • You do not need to “fix security everywhere” right now—focus on the registrar account, the domain-contact email, and DNS/hosting access first.
  • You do not need to publish a public statement unless there is clear customer risk (for example, phishing from your domain).

Important reassurance

This happens to competent people and organisations, often through email compromise or social engineering. Acting quickly and keeping good records can materially improve the chance of stopping further changes and recovering control.

Scope note

This is first-step guidance to stabilise the situation and preserve your ability to recover the domain. Later steps (formal disputes, complaints, legal action) may need specialist support.

Important note

This is general information, not legal advice. Registrar and registry processes vary by provider and domain type; follow your registrar’s security escalation process and keep evidence in case you need to prove ownership.

Additional Resources
Support us