[epc]

Pairdomains (pairdomains.com) offers it for $0.00/year.

But…be absolutely, 100%, certain that the information contained in the registry record is 100% accurate for name of registering organization and contact information. Because the process to unlock can be quite…difficult if the information is slightly off.

[EvangelicalPig]

pairdomains.com doesn't have serverUpdateProhibited, which is the "registry lock" protection. The reason why it costs money is because I believe it involves the registrant, registrar and registry coordinating a manual unlock out of band, so in theory if the registrar-registry API is compromised, you're still be protected.

[dwohnitmok]

An unfortunate side effect of defending against social engineering attacks that can use very small inaccuracies to be successful.