Tell HN: Namecheap gave my account to an unverified third party

A 13-year Namecheap customer discovered that Namecheap transferred full control of his account to an unverified third party after that person simply called support and asked. Despite Namecheap having already called the legitimate account owner to verify a prior support ticket, they bypassed all verification when the third party called in, changing both the password and associated email address. The account owner had already flagged the unauthorized password reset attempt via a support ticket, yet Namecheap still handed over the account. The incident highlights a critical account security vulnerability at Namecheap where phone social engineering alone is sufficient to take over any account.

Source: https://news.ycombinator.com/item?id=49028037. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.