Namecheap Account Compromised After Unverified Third Party Gains Access

Unauthorized Account Access Reported

A long-term Namecheap customer experienced unauthorized access to their account. A new leader of a college club, for which the customer maintained a domain, contacted Namecheap support. This individual successfully convinced Namecheap to change the account's password and associated email address, despite the domain being registered under the customer's personal details.

Prior Warning Ignored

The customer had previously received a password reset email initiated by the new club leader and immediately filed a support ticket with Namecheap, stating they did not initiate the request. Namecheap contacted the customer to verify the support ticket but subsequently allowed the third party to gain control of the account without further verification.

Security Vulnerability Identified

The incident points to a significant vulnerability in Namecheap's account security protocols. The customer noted that Namecheap was able to contact them for verification regarding their support ticket, but failed to apply similar rigorous verification when a third party requested account changes. This suggests that a simple phone call was sufficient to bypass security measures and gain control over an account.

Customer Response and Impact

Following the incident, the customer has begun transferring critical domains away from Namecheap due to concerns over the ease with which a third party could compromise an account. While the underlying issue of domain ownership was resolved between the customer and the club leader, the security lapse by Namecheap remains a concern for the customer.