A long-time Namecheap customer reported their account was compromised due to a lack of security verification. The user, who managed a domain for a college club, received a password reset email. They filed a ticket stating they did not initiate the reset, and Namecheap called to verify the ticket but then sent generic advice.

The incoming club leader, however, contacted Namecheap support and, with no further validation, convinced them the domain belonged to the club. Namecheap then changed the account password and associated email address. The user noted that while Namecheap verified their support ticket via phone, they failed to do so for the third party requesting access.

This incident led the user to move critical domains away from Namecheap, citing it as a "massive vulnerability" where an account can be taken over simply by asking. The user was ultimately able to connect with the new club leader and arrange the domain transfer.