What a domain hijacking looks like
The usual route is simple. Someone gets into your registrar account, with a phished password, a password reused from another site, or by talking a support agent into resetting it. Then they change where your domain points, or transfer it to a registrar they control.
CIRA, which runs .ca, describes what follows: your site swapped for a phishing page, your email intercepted, or a message you never wrote shown to your customers. The email part is the worst. Once someone receives your email, they can reset the passwords on your other accounts, including banking and social media.
The other way to lose a domain is to let it expire. I cover that in who really owns your website.
The locks, from free to serious
- Registrar or transfer lock. Free at most registrars. It blocks any transfer until you unlock the domain yourself. Turn it on and leave it on.
- The transfer code. Often called an auth code or EPP code, it is the key needed to move a domain. Treat it like a password and only request it when you are actually moving.
- Registry lock. This locks the domain at the registry itself, CIRA in the case of .ca, so changes need manual checks done offline. It holds even if your registrar account is compromised. It is not cheap: Webnames, a Canadian registrar, lists its Registry Lock at about $400 per domain. That is sensible for a bank or a large brand. For most small businesses, the free steps below do the job.
Protect the account, not just the domain
- Use a strong, unique password and two-factor login on your registrar account. Use a passkey if the registrar offers one; see passkeys and passwordless login.
- Use a recovery email on a different domain. If your registrar login is you@yourbusiness.ca and someone takes yourbusiness.ca, they also control your password resets. A separate, well-protected address avoids that trap.
- Keep your contact details current. CIRA can delete a .ca whose holder cannot be verified as meeting its Canadian presence rules, and the warnings go to the email on file.
- Remove old access. Former staff and past web designers should not still have logins.
- Ignore invoices from strangers. Letters and emails that look like renewal notices from companies you have never dealt with are a long-running scam. Renew only through the registrar you actually use.
A five-minute audit
Log in to your registrar today and check four things: transfer lock is on, two-factor login is on, auto-renew is on with a valid card, and the contact email is one you read. If you cannot log in at all, that is the first problem to fix. For the scam side of this, see phishing and social engineering.