I had an issue for a customer once where they had lost the root account credentials for their domain registrar, and it was the only vector they could use to per

I had an issue for a customer once where they had lost the root account credentials for their domain registrar, and it was the only vector they could use to perform some critical action. It was trivially easy on the phone to pretend to be the guy with approval (he was out of the country and uncontactable) and get the account reset. I could have then transferred the domain. A few years after that I had a similar issue with the same registrar, and they had added a cooldown, and review to the password reset process. But it was fundamentally the same and I was able to eventually repeat my process. Godaddy and a lot of other registrars are in the position of catering to extremely non technical people as part of their core business proposition but also, having the responsibility of protecting those people from fraud. Its rough designing processes that permit transfer at all for these people. I dont envy them, but its something they opted into.