Fradulent Domain Transfer Request

[Duke]

I have a question. I sent the usual electronic request via Enom to have a name I purchased transferred into my account. The seller wrote back wanting to know how he could be sure I was the one who initiated the request as the electronic form apparently says nothing about who sent it. I bought the name on Ebay and he said another guy contacted him after the sale and wanted the name badly. He is afraid that guy would put in the transfer request knowing that one would be placed by the winner (with the hope his request would get there first).

In seeing those screens myself before I don't recall seeing any info about who the request is from either. Are there any safeguards here to keep someone from making a fraudulent transfer request?

 

[DomainPairs]

Suggest that the seller sends you a message through Ebay's email system and includes a code word in it. You can then send him an email and include that code word to verify that you are the purchaser.

 

[Duke]

Originally posted by DomainPairs
Suggest that the seller sends you a message through Ebay's email system and includes a code word in it. You can then send him an email and include that code word to verify that you are the purchaser.

He knows I am the purchaser. What he can't be sure of is if the transfer page (which he reaches through a link sent by the registrar) was initiated at my reuqest or the request of someone who would like to steal the name. Of course he would end up getting two seperate requests, so we are waiting to see if another one shows up. He knows I sent one. If someone got one to him before me and he clicked OK to transfer the name could be lost though.

I am rather amazed that the electronic transfer systems these registrars use so not tell the seller where the request to transfer is coming from.

 

[GiantDomains]

Identify the registrar the request is from, and that should ease his mind.

 

[Duke]

Originally posted by doberry
Identify the registrar the request is from, and that should ease his mind.

The universal form that sellers are directed to does not name the registrar (it is used by several). I tried to call Enom this morning but just got a recording. I have wondered about this issue before when approving transfer requests myself. There is nothing on that form telling you or what registrar initiated the request.

Of course you are expecting a transfer request to come, but if it is a name you had on Ebay, a nonwinner could put in a transfer request before you and the seller might approve it before hearing from your. Seems like a very dangerous system but I have not seen it discussed before.

 

[GeorgeK]

Tucows/OpenSRS shows a WHOIS of the "before" transfer and "after" transfer, in the screen for accepting the transfer from the old registrar. That would help ensure that the transfer ends up in the right hands.

 

[GiantDomains]

Originally posted by Duke of Earl


The universal form that sellers are directed to does not name the registrar (it is used by several).

That "universal" form is enom and enom resellers. It is transparent, to create a private label for resellers.

 

[Ed30]

Duke - can't you open a free account where the name is now, get him to push it to you and then initiate another transfer yourself in a week or two?

 

[Duke]

Originally posted by Ed30
Duke - can't you open a free account where the name is now, get him to push it to you and then initiate another transfer yourself in a week or two?

No, his current registrar doesn't allow that (why people stay at registrars like this - I have no idea).

Doberry's comment on the form is helpful. He sent me this link:

http://www.transfer-approval.com

I recognized that as a form I always see for Enom transfers but did not know it was Enom only. So I know his transfer request came from Enom (still not totally reassuring). But since the request he got matches this and he has received no other requests I am 99.9% sure what he has is the request I initiated. Still seems like there should be an identifier on that form as to who is making the request as George indicates there is at Tucows.

 

[Bob]

This is an interesting situation. I had never thought about it before.

-Bob

 

[Duke]

Originally posted by Bob
This is an interesting situation. I had never thought about it before.

-Bob

It has crossed my mind before when seeing the Enom form but I never gave it really serious thought until the seller in this transaction expressed deep reservations. When I really looked at it I realized it could be very easy to steal an occasional domain that way. Enom has not answered my call but I will grill them on that point when they do. They really should have something identifying who initiated the transfer request.

 

[DomainPairs]

I've just been looking at my transfers, and it looks as if all you get is the registrar name. It would be sensible if they added an account identifier, even if it was just the last 2 digits.

 

[GiantDomains]

Originally posted by DomainPairs
I've just been looking at my transfers, and it looks as if all you get is the registrar name. It would be sensible if they added an account identifier, even if it was just the last 2 digits.

Pairs: Registrar transfers are not designed to supplant ownerhip transfers. They are supposed to be performed by the owner of the name, for the purpose of changing registrars, not owners.

Duke: He cant push it to a new account, wherever its regged?

If not, just have him create an enom account, initiate a transfer, and when it goes through, push it to your enom account.

 

[Duke]

Originally posted by doberry
Duke: He cant push it to a new account, wherever its regged?

If not, just have him create an enom account, initiate a transfer, and when it goes through, push it to your enom account.

We had waited awhile and he received no other transfer requests other than the original one that we know was from Enom (and I'm sure was mine) so he went ahead and approved the transfer today. I'll feel better when I receive it of course. His registrar wouldn't allow him to set up a new account for me and push it there (that's a registrar destined to wind up with no customers).

Your idea about him setting up a new Enom account and moving it there, then pushing doesn't address the original problem. The way the Enom screen currently reads, he wouldn't even know if the transfer request he is acting on was the one he sent or one initiated by someone else!

Of course the time frame and circumstances have a lot to do with this. If you do a private deal with someone no one else would know to put in a transfer order. But if you buy it in a public venue like Ebay, a thief could put in a transfer request at the end of the auction and you could put in one - but when the email comes with the link to approve the transfer the owner would have no way of knowing who he is approving the move to. If the thief's request got to him first the domain is gone to the wrong party.

Enom still hasn't answered the message I left for them. I'd like to know what they have to say about it.

 

[RON2]

If you have a eNom reseller account, you can enter your Organization name and website URL under 'My Enom -> My Info'

This name will appear on the transfer request sent to the domain holder.

 

[Duke]

Originally posted by -RJ-
If you have a eNom reseller account, you can enter your Organization name and website URL under 'My Enom -> My Info'

This name will appear on the transfer request sent to the domain holder.

Thanks for that tip -RJ-! I do have a reseller account and I did have the Organization filled in there, but not the URL. He didn't mention seeing any identifying company name on the transfer form (he has since OKed the transfer so no longer has access to it to double check). I went ahead and filled in the URL and the next time I do a transfer (I often initiate them myself to bring names in from another registrar) I will make a point of looking for that. If it shows up that would certainly solve my problem!

 

[Duke]

Enom Support just called me back and I talked about this situation with them. As -RJ- suggested, if you have an Enom reseller account, be sure you have filled in your organization name and URL under My Enom > My Info. Then those two pieces of information should appear at the bottom of the transfer screen the domain owner will see. I did have the Organization name filled in (not URL) and the seller did not mention seeing it. He may have just overlooked it, but I didn't see the screen myself so I can't say for sure.

If you are not a reseller, the screen will just say Enom somewhere on it (my guy didn't even mention seeing that). The support guy acknowledged that there is a danger that someone could steal a name in this way but it is rare. It would be a good idea to make sure you tell the domain owner what registrar the transfer request will come from and what organization name to look for at the bottom (ifyou are have a reseller account).

In my case, for example, he would have known not to send it anywhere but Enom. If the person attempting a theft also happened to have an Enom account and beat you to the punch with the transfer order, Enom told me they would work with you and the seller to get the name transferred from the theif to your account (which they could do since it would be in their system).

Also, if you initiate a transfer request and someone else has already put one in on that name, you will get an error screen telling you a transfer is already in progress. Then you will know someone is trying to swipe it and you should call Enom right away.

You can bet I will be taking a very close look at that transfer screen the next time I move a domain in from another registrar though!

 

[Duke]

Originally posted by BigFart
Duke,

I just did a couple of transfers from DotRegistrar to ENOM today and the transfer screen did have my company name at the top.

The information about transfer in progress is also very helpful.

Thanks for the note David. The name I transferred hasn't arrived yet but I feel pretty good about it because it is in processing. That means no one else could put a transfer order in on it. Mine never would have been listed as processing if someone had gotten a transfer order in before me. Instead I would have just gotten the error message I mentioned before. As oon as a transfer order is put in by anyone Enom told me the domain is flagged and no one else can enter a transfer order on it.

 

[.com.net.org]

You can ask the seller to change the email to your email.
And then you initiate transfer for that domain.

transfer-approval.com will send the email to your email, which you can approve yourself.

Hope this help.

 

[Duke]

Originally posted by .com.net.org
You can ask the seller to change the email to your email.
And then you initiate transfer for that domain.

transfer-approval.com will send the email to your email, which you can approve yourself.

Hope this help.

That's a good tip .com.net.org - Thanks!

I'm still waiting on the domain to arrive, but it can take 1-7 days so no sweat.....yet.