“Namecheap stole my domain” is a phrase we hear from panicked owners several times a month. In almost every case the registrar did not take anything. Namecheap is a large retail registrar popular with individuals and small businesses, and the owner is usually looking at one of four ordinary situations: a compromised account, an expired registration, a privacy service that looks like a stranger’s name, or a developer who registered the domain under their own login. Each has a different fix, and the first job is to work out which one applies. This guide explains how, and when to escalate to the procedures described in our domain hijacking hub.
What people usually mean when they say Namecheap stole the domain
The account was compromised
The most serious scenario is genuine domain hijacking (the unauthorized transfer or control of a registered domain). An attacker obtains the account password, often through phishing or a password reused from a breached service, logs in, and pushes the domain to another Namecheap account or transfers it to a different registrar. The registrar processed a request from an authenticated session. Namecheap offers two-factor authentication, and the accounts we see hijacked are the ones not using it. Our page on what domain hijacking is describes the pattern.
The registration expired
The second scenario is expiration. The card failed, the reminders went to an old address, and the domain lapsed. Under ICANN’s Expired Registration Recovery Policy, registrars must send two expiration notices, roughly one month and one week before expiration, plus a further notice within five days after, and gTLD registries must offer a 30-day Redemption Grace Period after deletion, according to the ICANN ERRP redline of February 2024. That is expiration, not theft, and it has its own path through our expired domain name recovery service.
The WHOIS privacy service looks like a new owner
Namecheap applies free WHOIS privacy (a proxy service that substitutes the provider’s contact details for yours in the public record) by default. Owners who see an unfamiliar organization name in a lookup sometimes conclude the domain has changed hands. It has not. The registrant is still you; the public record is masked. This is the case most often mistaken for theft.
A developer or agency holds the registration
The fourth scenario is a web developer, agency or former employee who registered the domain in their own Namecheap account. When the relationship ends, the domain stays with them. Namecheap sees a legitimate account holder; you see a domain you paid for withheld. We cover that situation in our post on recovering a domain held for ransom by a web developer.
How to tell which situation you are in
Run an RDAP lookup (RDAP, the Registration Data Access Protocol, is the structured successor to WHOIS) and read four fields. The sponsoring registrar tells you whether the domain is still at Namecheap. The creation date tells you whether this is your original registration or a fresh one after a drop. The updated and expiration dates show what changed and when. The EPP status codes are the most telling: clientTransferProhibited means the domain is locked at the registrar, pendingTransfer means a transfer is in flight, and redemptionPeriod or pendingDelete means the registration expired. If the registrar is still Namecheap and the creation date is yours, you are in the privacy, expiration or developer scenario. If the registrar has changed and the dates are recent, treat it as a hijack.
What to do at Namecheap for each scenario
If the account was compromised, start with Namecheap’s account recovery process, which verifies your identity before restoring access, and report the unauthorized transfer through its support and abuse channels in the same message. Give the date you lost access, the last legitimate change you made, and a clear request for a transfer reversal. If the domain left Namecheap, Namecheap is the losing registrar and the party that can contact the gaining registrar for you.
If the registration expired, log in and renew immediately if the domain is still renewable. If it has entered redemption, ask Namecheap to restore it during the grace period. If it has dropped and been re-registered, the registrar cannot return it.
If the privacy service is the only thing that changed, log in, confirm the registrant contact under the domain’s settings, and enable two-factor authentication while you are there.
If a developer holds the domain, Namecheap will not move it between accounts on your word alone, because to the registrar the developer is the registrant. The paths are a push from the developer, a negotiated transfer, or a legal claim on your agreement and trademark rights.
Escalating beyond the registrar
When a domain has been transferred away, time matters. ICANN’s Transfer Policy requires each registrar to staff a Transfer Emergency Action Contact (TEAC), and a human at the gaining registrar must respond within four hours, though final resolution may take longer, according to the ICANN Transfer Policy Review working group’s TEAC and TDRP slides. Only the losing registrar can open that channel, so your first message to Namecheap must say plainly that you are reporting an unauthorized transfer. Registrars reverse a transfer between themselves with the Transfer Undo Request Form; our guide to the TURF agreement explains how. If the registrars disagree, the Transfer Dispute Resolution Policy (TDRP) lets one registrar file against the other, but no later than twelve months after the alleged violation, per the ICANN TDRP text. Our step-by-step guide to recovering a stolen domain name covers the full sequence.
Evidence to preserve
Save what proves the domain was yours: the original registration receipt, renewal invoices, and your email history with Namecheap, including expiration notices or a transfer-approval email you never sent. Screenshot the RDAP record now and again each day, because status codes and registrar fields change as a transfer completes. Keep login-alert emails and any phishing message you suspect started the chain. A registrar, a TEAC contact or a court will ask for these.
How DNAccess helps with a Namecheap domain
DNAccess has recovered hundreds of stolen domain names, and the work begins with the diagnosis above: hijack, expiration, masked record or developer dispute, then the right channel with the right evidence. We handle registrar correspondence, TEAC and TURF requests and, where needed, litigation through our stolen domain name recovery service. Afterward we lock it down following our guides on registrar account security and how to prevent domain hijacking. Contact us for a confidential assessment.
We have written the same guide for GoDaddy, Squarespace, Cloudflare and Google Workspace.