[dalmo3]

I've had the exact same issue with a small local registrar.

Had an account where I managed multiple clients. One of the clients had their "IT guy" contact the registrar for a DNS change. The registrar promptly gave the guy full access to my account, changing the password and locking me out in the process.

As soon as I regained access I moved everything off there.

[sixtyj]

Don’t be shy. Tell us the name.

This is unacceptable and such companies should change their policy or be out of business.

[ivanmontillam]

And it wouldn't even be a defamation lawsuit because it's true.

[rmunn]

In countries with a sensible legal system, yes. Truth is not a defense against defamation in all countries. I can't know what country you (generic you) are in, so best to look up your local laws on defamation.

[preg_match]

This is basically sim swaps attacks or number porting attacks but for domains.

If the telecos can figure it out, anyone can. Yes it took them way too long, but those attack vectors are essentially dead now.