Fraudulant Domain Transfer Request

if your email address does not work, you may lose your domain name

[foodconsumer]

1) I have domain names registered through tucows.

2) Today I was notified by tucows that a domain name registrar transfer request was received. And I was advised to respond in 5 days. If I fail to respond, the domain name will be automatically transfered out even without my authorization.
3) The fact is, I did not place the request. The regstrar transfer request is fraudulant.

Luckily, my admin contact email works, and I have a chance to notice the request, so I can respond to decline the transfer.

But the fear is there, suppose

1) my email address does not work,
2) Suppose I did not see the transfer confirmation from tucows in time. Which is possible because so many spam emails coming in my mailbox, it's easy for me to lose that notice.
3) Suppose I mistakenly confirm it wrong. Say when I intend to reject the transfer, but somehow I clcik on the button to unintentionally approve the transfer.

therfore, this tucows policy has creasted a real loophole for fraudulant transfer.

My qustion is, is this 5 day response a ploicy set by ICANN or just tucows?

Thanks.

[uncle_bob]

Some registrars allow you to lock the domains from their web interface , so no transfer requests are ever accepted until you unlock the domain. Much safer option IMHO.

[Webwork]

Certainly food for thought ;-)

[digitalv]

That's really odd, are you sure that came from Tucows? Every transfer request I've ever received from them says if I take no action in 5 days the request will be deleted - quite the opposite from losing my domain :)

[foodconsumer]

Firs of all, I checked my backend control panel, and found that someone did place the transfer reque3st. I was thinking to lock it, but I could n ot because I was told that the domain name was transfer pending. So this is really.

Second, tucows made it clear that if I did not respond in 5 days, it will be automatically transferred.

<Sorry, no email excerpts. See TOS [webmasterworld.com]>

This practice is extremely unfair to registrants. Registrants have no obligation to respond to any fraudulant transfer request. Now if you do not respond, you are guilty anmd the penalty is " you lose your domain name".

Because of this, there is a huge loophole for some illicit people to fish some domain names from others by placing fraudulant transfer request.

The danger is real because there are quite some possibilities that would make such a fraud a reality.

I notified my clients of this risk and wait for their response and see what to do to eliminate this risk.

I never heard that the burden would be placed on bthe registrant for a false request.

[edited by: tedster at 4:00 am (utc) on July 20, 2004]

[vkaryl]

Scary. I don't get this with my registrar. Nor with the one before this one....

Ugh. Ditch Tucows?

[tedster]

Are you sure that you aren't being phished, spoofed, scammed here?

I've never heard of any registrar putting through a transfer without POSITIVE action from the owner of record. I suggest you contact Tucows by phone on this issue. I would not assume that their policies are as dicey as this seems on the surface.

[Leosghost]

worked with tucows for along time via open srs ..never heard of this ..like Ted says sounds like complex phishing ..phone them

[digitalv]

I agree with Tedster, I'm with OpenSRS and have never received a message as you described. I just went through my e-mail and found a transfer message. This was 5/7/2004 - I don't recall receiving any notices saying this process has changed, but this is an actual transfer request I received and the domain in question (which I've blocked out per TOS) is under my OpenSRS account:

Note: We cannot re-publish even a short quote from any email.
But as was mentioned earlier, this actual Tocows transfer notice
required a positive action from the domain holder. If no action
was taken it would not result in a transfer.

Thanks for taking the time to find this confirmation, digitalv.

-Tedster

Reference TOS #9 [webmasterworld.com]

This took me a while to find so thank me :P

[edited by: tedster at 5:43 pm (utc) on July 20, 2004]

[jeepfun]

Not sure on the policies of Tucows but I can tell you this. Per the new ICANN transfer policy which the Registrars have until November to implement, the losing Registrar can NO longer deny a transfer request because they did not hear back from the current Registrant or authorized contact for a domain. They can only deny the request if they have outstanding payment to them and/or the contact actively denies the request per the communication from the Registrar. The only other mechanism to stop the transfer is to have the domain on Registrar LOCK in which case the Registry denies the transfer request immediately.

See the policy at: [icann.org...]

ICANN was actually beat up at the previous ICANN meeting by Network Solutions for this but their objections were pushed aside and no other Registrar really complained about it. Speculation is that this rule hurts Netsol more than the other Registrars -- without any consideration to the Registrants.