Almost every hijacked domain is lost through the account, not through the registry. There are four places to close. 1. The registrar lock With the lock on, the registry refuses transfer requests even if somebody has the transfer code. Keep it on for every domain and turn it off only while you are actually transferring out. That extra step is the point: it separates a mistake from a theft. 2. The account password Use a long password that you do not use anywhere else. Password reuse is how a breach at an unrelated website turns into a lost domain. If you use a password manager, let it generate the password. 3. Two-factor authentication Turn it on. It means a stolen password is no longer enough. Store the recovery codes somewhere you can reach if the phone is lost, otherwise a lost device becomes a locked account. 4. The registrant email This is the quiet one. Transfer confirmations go to the registrant address, so whoever reads that mailbox can approve a transfer. Protect it with two-factor authentication of its own, and check regularly for forwarding rules you did not create. Other things worth doing Set up separate contacts rather than sharing one login between several people, so removing somebody does not mean changing the password everyone uses. Review the domain list now and then. An unfamiliar name, or a nameserver you did not set, is the earliest sign that something is wrong. If you think a domain has been taken Change the account password and the registrant mailbox password first. Check the nameservers and DNS records for entries you did not create, and look for new forwarding rules in the mailbox. Then open a ticket and describe what you found - keep screenshots and the original emails. We will never ask for your password or a two-factor code by phone, chat or email. If somebody does, stop and contact us through the client area instead.