That's way too complicated for the average registrant. There are lots of practical options that could strengthen the process for the average registrant. Half

That's way too complicated for the average registrant. There are lots of practical options that could strengthen the process for the average registrant. Half the battle is for registrars to quit accepting the equivalent of cold calls from registrants. How hard is it to make a call back to the registrant when they're asking for NS, MX, etc. changes? If the registrant phone number hasn't changed since registration, it's pretty safe to call them back and trust them IMO. If the registrant phone number was changed 5 days ago and someone is calling in asking for changes, that's an easy red flag and could be coupled with a technical restriction that requires escalation for important domain changes. Another option similar to yours but easier would be to set a pin during registration and to require it for making over the phone domain changes. I guarantee those will get lost / forgotten by the average registrant though. You'd be shocked at the number of small businesses that don't know where there domain is registered, who registered it, when it expires, etc.. If a domain is making money use a registry lock. If it's a high value domain making tons of money, pay MarkMonitor or similar to manage it.