We nearly had something like this happen to Fastmail many years ago: https://fastmail.blog/2014/04/10/when-two-factor-authentication-is-not-enough/ https://fas

We nearly had something like this happen to Fastmail many years ago: https://fastmail.blog/2014/04/10/when-two-factor-authentication-is-not-enough/ https://fastmail.blog/2014/04/10/when-two-factor-authenticat... Scary stuff. Basically we had 24 hours to dispute via email when a fax was sent to our registrar with a faked up Australian company registration and a fake passport asking to remove 2FA and change the owner email to an address @qq.com. At the same time, our hostmaster email address had been signed up to hundreds of non-double-opt-in mailing lists, so that there was lots of noise for this email to be lost in. We had to fight very hard to be allowed to see the fax that was allegedly from us, so that we could see what they had done.