GoDaddy customer claims registrar transferred 27-year-old domain without any security checks

### Executive summary A nonprofit's long-established domain was transferred out of its GoDaddy account without the required authentication or documentation, causing four days of service and email disruption and exposing the organization to phishing, business email compromise, and account-recovery risks; the domain was eventually recovered with help from the unintended recipient rather than through GoDaddy support, and GoDaddy asserts it followed procedures while Flagstream disputes that claim.