Summary. A stolen domain name is a theft problem first and a trademark problem second, and the remedies that work depend on how the name was taken and where it went. This article explains the common hijacking methods, from registrar account takeover and SIM swaps to lapsed registrant email domains and developers who registered the client's name in their own account, and separates registration hijacking from DNS hijacking. It then walks through the recovery paths in the order they usually matter: the registrars and the ICANN Transfer Policy, the registrar-only Transfer Dispute Resolution Policy, the UDRP and its limits, the in rem action under the Anticybersquatting Consumer Protection Act, state-law conversion following Kremen v. Cohen, and federal computer-crime and stored-communications claims. It tells the key cases as stories, flags open questions such as how the re-registration split applies to thieves, and gives each side practical guidance. An extended worked example, common mistakes, an FAQ, and takeaways close the article.

At 6:40 on a Saturday morning, the owner of a small coffee roaster in Portland opens her laptop to check weekend orders and gets a browser warning instead of her storefront. Her customer email inbox is silent, which is strange for a Saturday. By eight o'clock she has worked out three things. Her registrar account shows a password change she did not make. The domain her business has used for eleven years is no longer listed in the account at all. And a lookup on the public registration database shows the name now sits with a registrar she has never heard of, in a country she has never visited, with every registrant field redacted for privacy.

She calls her web developer, who tells her to call the registrar. The registrar's support line opens at nine and tells her that the transfer was "authorized with the correct code," that the name has left their system, and that she should "contact the new registrar." The new registrar does not answer the phone. By Monday, a domain marketplace lists her business name for sale at a price that would wipe out her year's profit.

This happens more often than most businesses realize, and the law has more to say about it than most victims are told. The difficulty is that the remedies are scattered across four systems that were built for other purposes: ICANN's contractual policies for registrars, an arbitration-like process designed for cybersquatting, a federal trademark statute with an unusual in rem provision, and ordinary state tort law that took years to decide whether a domain name is even property. Getting a stolen name back depends on knowing which of those systems fits the facts and moving through them in the right order.

The short answer

  • Most domain thefts are account takeovers, not hacking of the domain system itself. Someone gets into the registrar account, the email account that controls password resets, or the phone number that receives verification codes, and then uses the registrar's normal transfer process to move the name. The transfer looks legitimate on paper because, from the registrar's point of view, the right credentials were used.
  • Speed matters more than theory. A name that is still at the original registrar, or that moved only once, can often be recovered informally within days. A name that has moved two or three times, been sold, and resold is a litigation project.
  • The registrar is the first and best recovery channel. ICANN's Transfer Policy gives registrars an emergency contact process and lets them reverse improper transfers by agreement. When they disagree, the registrar (not the victim) can file under the Transfer Dispute Resolution Policy (TDRP).
  • The UDRP can work for stolen names, but only if the victim has trademark rights. A thief has no rights or legitimate interests in a name obtained by fraud, and panels treat theft as bad faith. A victim who held a generic or investment name without any mark usually cannot use the UDRP at all.
  • The in rem action under 15 U.S.C. § 1125(d)(2) is the strongest court tool against an anonymous foreign thief. It is filed against the domain name itself, in the district where the registry sits (for .com and .net, the Eastern District of Virginia), and it ends with an order directing the registry to return the name. It, too, requires a trademark.
  • Domain names are property in many jurisdictions. After Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003), a victim can sue for conversion, and the sex.com saga shows that a registrar that hands a name to a forger can share the liability. State law is not uniform, and Virginia has treated a registration as a contract for services.
  • The thief is often also a computer criminal. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and the Stored Communications Act, 18 U.S.C. § 2701, give civil claims against the person who broke into the accounts, and a law enforcement referral can produce restitution.
  • Prevention is cheap and works. Registry lock, hardware-key multifactor authentication on the registrar account, a registrant email address on a domain the company controls, and a registrar account owned by the company rather than an employee or a developer stop most of these thefts.

Why domain theft is different from cybersquatting

Most of the law about domain names was written to deal with cybersquatting: someone registers a name that copies a trademark, hoping to sell it to the brand owner or profit from the confusion. MC Law's survey of that body of law is Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP. A stolen domain is a different event. The victim was the registrant. Someone took the registration away without permission.

The difference matters in three ways.

First, the victim's rights do not depend on a trademark. A person who registers a name owns (or, depending on the state, holds a contract right in) that registration whether or not it matches any mark. A trademark helps only because the fastest administrative and federal remedies happen to be trademark remedies.

Second, the timeline for bad faith runs differently. In a cybersquatting case, the question is usually whether the registrant acted in bad faith when it registered the name, years ago. In a theft case, the "registration" by the thief happened last week, and the bad faith is obvious: the thief obtained the name by fraud.

Third, the defendant is a criminal, not a business rival. Thieves rarely answer complaints, often sit outside the United States, and frequently resell the name quickly to someone who may or may not know it was stolen. The legal path has to be built for a defendant who will not show up and a domain that may have moved on to a third party.

For the general menu of domain procedures and how to pick among them, see Choosing the Right Domain Name Dispute Procedure: A Practical Guide. This article focuses on the theft scenario and goes deeper into the registrar, criminal, and property-law channels that cybersquatting guides treat in a paragraph.

How a domain name works, in the parts that matter for theft

A domain name has three layers, and theft can happen at each.

The registry operates the top-level domain. Verisign operates .com and .net from Reston, Virginia. Other registries operate .org, .info, the hundreds of newer generic top-level domains, and the country-code domains. The registry keeps the authoritative database of which registrar sponsors each name and which name servers it points to. The registry is the one place every name in the top-level domain must be recorded. For a primer on the registry system, see Top-Level Domain Names: An Overview.

The registrar sells the registration to the customer, holds the customer's account, and submits changes to the registry. Accredited registrars sign the ICANN Registrar Accreditation Agreement (the 2013 RAA, as amended) and must follow ICANN's consensus policies, including the Transfer Policy and the Expired Registration Recovery Policy. Resellers sit between some customers and their registrars, which adds a link to the chain.

The registrant is the person or entity listed as the holder of the name. Since the European General Data Protection Regulation took effect in 2018, registrars redact most registrant data from public lookups. ICANN moved the public lookup system from the old WHOIS protocol to the Registration Data Access Protocol (RDAP), and its Registration Data Policy replaced the temporary post-GDPR rules. Requests for non-public data now go to the registrar directly or through ICANN's Registration Data Request Service (RDRS), launched in November 2023 as a pilot. Registrar participation is voluntary and disclosure is not guaranteed, so expect uneven results.

Two sets of status codes control what can happen to the name. Codes beginning with "client" (for example, clientTransferProhibited) are set by the registrar, often at the click of a button in the customer's account. Anyone who gets into the account can usually turn them off. Codes beginning with "server" (serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited) are set by the registry. When a registry offers Registry Lock, those server codes can be removed only through an out-of-band verification process involving named individuals at the registrar and registry, often by phone with passphrases. A thief who has the customer's password cannot remove a registry lock. That single fact explains why registry lock is the most effective anti-theft measure available.

How hijacking happens

The methods have changed less than the headlines suggest. Almost all of them target the people and accounts around the domain rather than the domain system.

Registrar account takeover

The common case. The thief obtains the login for the registrar account through a phishing page that imitates the registrar's login screen, credential stuffing (reusing a password leaked from another site), malware on the owner's computer, or a password reset sent to an email account the thief already controls. Once inside, the thief unlocks the name, requests the authorization code (the "auth code" or EPP code, which ICANN's pending Transfer Policy revisions rename the Transfer Authorization Code), and initiates a transfer to a registrar of the thief's choosing. Some thieves first change the registrant email address so that transfer confirmation messages go to them. Others change the name servers to point traffic at their own servers while they wait out a lock.

Email account compromise

The registrar account usually resets through the registrant's email. Whoever controls that inbox controls the domain. This is why business email compromise and domain theft so often travel together, and why the person who broke into the inbox may be liable under the Stored Communications Act as well as for the theft. An especially quiet version of this attack exploits a lapsed email domain: the registrant contact address on a valuable name is something like owner@old-agency-name.com, the old agency's domain expired years ago, and the thief registers it, sets up a mailbox, and resets the registrar password. Nothing in the victim's own systems was touched.

SIM swaps and phone-based verification

When the registrar account uses text-message codes for multifactor authentication or account recovery, a thief who can persuade a mobile carrier to move the victim's phone number to a new SIM card gets the codes. The Federal Communications Commission adopted rules in 2023 requiring wireless carriers to use secure methods to authenticate customers before SIM changes and number ports and to notify customers of those requests, codified in its customer proprietary network information rules at 47 C.F.R. Part 64. In July 2024, however, the FCC waived the compliance deadline until its information-collection review is complete, so carrier practices still vary. The practical lesson is simpler than the regulation: do not use SMS codes to protect a domain that matters.

Social engineering of registrar support

The oldest technique is still effective. The thief calls or emails the registrar's support staff, impersonates the owner, and talks the agent into resetting the account or changing the email address. In the most famous domain theft in history, the thief did not even need a phone call. He mailed a forged letter.

Insiders, former employees, and web developers

Many "stolen" domains were never stolen in the criminal sense. A marketing employee registered the company's name in a personal account in 2012 and left in 2019. A freelance web developer bought the domain for a client "to save time," listed himself as the registrant, and now says the client owes him money. An agency that built the site holds dozens of client domains in one account and goes out of business. These are ownership disputes, and they turn on contract, agency, and property law rather than on computer crime. The work-made-for-hire doctrine is no help: it is a rule of copyright authorship under 17 U.S.C. § 101 and 17 U.S.C. § 201, and a domain name registration is not a work of authorship. The client's arguments are that the developer registered the name as the client's agent, holds it for the client's benefit, and must turn it over under the engagement terms or general agency principles. For the parallel problem with brand ownership, see Who Owns the Brand: Trademark Ownership Disputes Between Co-Founders, Bands, Licensees, and Distributors.

Expiration and drop-catching

A name that expires is not stolen, even if the loss feels like theft. When a registration lapses, ICANN's Expired Registration Recovery Policy requires registrars to send renewal reminders before expiration and shortly after it, to interrupt the name's resolution path at some point after expiration so the owner notices, and to give the registrant a window to renew. Most generic top-level domain registries then offer a 30-day Redemption Grace Period during which the registrant can restore the name for a fee. After that, the name enters a short pending-delete period and drops, and specialized "drop-catching" services race to re-register it within seconds. Once a third party has lawfully registered a dropped name, the original owner's remedies are mostly trademark remedies, and the registrar is rarely liable. That was the lesson of Rigsby v. GoDaddy Inc., 59 F.4th 998 (9th Cir. 2023), discussed below.

Registration hijacking versus DNS hijacking

Lawyers and clients often use "hijacking" for two different events. In a registration hijack, the thief takes control of the registration itself and usually moves it to another registrar. In a DNS hijack, the registration stays where it is, but the thief changes the name server records (at the registrar or at the DNS hosting provider) so that the domain's traffic and email flow to servers the thief controls. DNS hijacks are often the work of sophisticated actors who want to intercept email or credentials rather than sell the name. Public reporting has described campaigns against government and telecommunications domains, and in January 2019 the federal Cybersecurity and Infrastructure Security Agency issued an emergency directive ordering federal agencies to audit their DNS records and add multifactor authentication after a wave of DNS tampering. A related risk is the "dangling" record: a subdomain that still points to a cloud resource or a name server the company no longer controls, which an attacker can claim.

The legal response to a DNS hijack is mostly technical and contractual (restore the records, lock the account, investigate the breach), plus incident-response obligations if data was intercepted. See Responding to a Data Breach: The First Seventy-Two Hours. The rest of this article focuses on registration hijacks, where the name has left the owner's control.

Some history, told through the cases

The sex.com letter: is a domain name property?

In 1994, Gary Kremen registered sex.com with Network Solutions, which at the time was the sole registrar for .com and gave registrations away for free. The next year, a con man named Stephen Cohen sent Network Solutions a letter that purported to come from Kremen's company. It said the company had been "forced to dismiss" Kremen, that it was abandoning the domain, and that it authorized transfer to Cohen. The letter was a forgery. Network Solutions transferred the name anyway, without checking with Kremen.

Cohen turned sex.com into a hugely profitable business. Kremen sued him and won a judgment of about $65 million, which Cohen avoided paying by moving money offshore and fleeing. Kremen then sued Network Solutions. The district court rejected his conversion claim on the theory that a domain name is intangible and California conversion law required tangible property or a document in which intangible rights were merged.

The Ninth Circuit reversed in Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003). Writing for the court, Judge Kozinski applied a three-part test for property: an interest capable of precise definition, capable of exclusive possession or control, and capable of giving rise to a legitimate claim of exclusivity. A domain name meets all three. Like a share of stock, the court said, it is a well-defined interest; the registrant decides where on the internet it points; and registrants have a legitimate expectation that the name is theirs. The court also held that, to the extent California required intangible property to be merged with a document, the registry's database was close enough. And it rejected the idea that Network Solutions could escape liability because it had acted in good faith: conversion is a strict liability tort, and a party that hands someone else's property to a thief on the strength of a forged letter has converted it. The breach of contract claim failed, because Kremen paid nothing for the registration.

Kremen is the foundation for every domain theft case in the Ninth Circuit and much of the persuasive authority elsewhere. It means a theft victim can plead conversion against the thief and, sometimes, against an intermediary that transferred the name on obviously fraudulent instructions. Modern registrars protect themselves against that second possibility with terms of service that disclaim liability and require arbitration, and with the statutory limits discussed below, but the property holding stands.

Umbro: Virginia sees a contract, not a thing

The Supreme Court of Virginia came out the other way on a related question three years earlier. In Network Solutions, Inc. v. Umbro International, Inc., 529 S.E.2d 80 (Va. 2000), a judgment creditor tried to garnish a debtor's domain names held at Network Solutions, which was based in Virginia. The court held that a domain name registration is the product of a contract for services between the registrar and the registrant, and that the services are not a "liability" subject to garnishment under the Virginia statute. The court was careful to say it did not decide whether a domain name is intellectual property.

Umbro matters to theft victims for two reasons. Virginia is where Verisign sits, so it is the forum for many in rem actions against .com and .net names, and a court there will think about domain names through the Virginia case. And it shows the remaining split: in some states, a domain name is property that can be converted, and in others, the registrant's right is contractual. The difference changes which claims you plead and whether a state-law theory alone can support in rem jurisdiction.

Office Depot and the location of a domain name

A domain name has no physical location, but courts need one. In Office Depot, Inc. v. Zuccarini, 596 F.3d 696 (9th Cir. 2010), a judgment creditor of John Zuccarini, a notorious typosquatter, registered its judgment in the Northern District of California and asked the court to appoint a receiver under Fed. R. Civ. P. 66 to seize and auction his domain names. Zuccarini argued that the names were not located in California. The Ninth Circuit held that, for this purpose, a domain name is located where its registry is, borrowing the logic of the ACPA's in rem venue provision, and that the court therefore had jurisdiction to reach the names. The holding gives theft victims a principled answer to the question of where a domain "is" for purposes of state-law property remedies: it is where the registry keeps the authoritative record.

Porsche and Harrods: Congress's answer to the absent defendant

Before 1999, trademark owners who found their marks registered as domain names by anonymous or foreign registrants had nowhere to sue. Congress's response, the Anticybersquatting Consumer Protection Act, included an unusual in rem provision. The two leading Fourth Circuit cases from 2002 shaped how it works.

In Porsche Cars North America, Inc. v. Porsche.net, 302 F.3d 248 (4th Cir. 2002), Porsche sued dozens of domain names in the Eastern District of Virginia, the registrar's district. The British registrant of one name offered, late in the case, to submit to personal jurisdiction in Virginia, which would have converted the case into an ordinary lawsuit against him. The Fourth Circuit held that the late offer did not defeat the in rem proceeding, which had been properly brought when the registrant was beyond the court's personal jurisdiction. In Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002), the London department store sued 60 names registered by a former Argentine affiliate. The court held that the in rem provision covers not only bad-faith registration claims but also infringement and dilution claims, and that exercising in rem jurisdiction over a domain name whose ownership is the subject of the dispute is consistent with due process under Shaffer v. Heitner, 433 U.S. 186 (1977).

Other courts drew the venue line tightly. In Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002), the Second Circuit held that an in rem action must be brought where the registrar, registry, or other domain authority is located, and in FleetBoston Financial Corp. v. FleetBostonFinancial.com, 138 F. Supp. 2d 121 (D. Mass. 2001), a Massachusetts court dismissed an in rem case filed in the trademark owner's home district. The result is that .com and .net in rem cases concentrate in the Eastern District of Virginia, which has seen enough of them that its judges and clerks know the drill. Representative examples include Caesars World, Inc. v. Caesars-Palace.com, 112 F. Supp. 2d 502 (E.D. Va. 2000), Cable News Network L.P. v. CNNews.com, 162 F. Supp. 2d 484 (E.D. Va. 2001), and America Online, Inc. v. AOL.org, 259 F. Supp. 2d 449 (E.D. Va. 2003).

These were cybersquatting cases. But the same procedure works against a thief, and the in rem action's defining feature, that it needs no defendant, fits theft better than it fits most squatting.

Rigsby: when the registrar is not the villain

Scott Rigsby, a Paralympic athlete and motivational speaker, lost the domain for his foundation when a registration payment failed and the name lapsed. A third party registered it and used it for an unrelated gambling site. Rigsby sued GoDaddy, the registrar, among others. In Rigsby v. GoDaddy Inc., 59 F.4th 998 (9th Cir. 2023), the Ninth Circuit held that the registrar was not liable under the ACPA because its role did not extend beyond registering the name for the new registrant, and that 47 U.S.C. § 230 barred the state-law claims that sought to hold it responsible for the third party's content.

Rigsby is a lapse case, not a theft case, but it frames the registrar's position in both. The Lanham Act itself limits registrar liability. Under 15 U.S.C. § 1114(2)(D), a registrar is not liable for damages for registering or maintaining a name for another absent a bad-faith intent to profit, and it is protected when it suspends, transfers, or cancels a name under a reasonable policy (such as the UDRP) or in response to a court order. Courts have also rejected contributory liability theories against registrars that merely provided registration services, Lockheed Martin Corp. v. Network Solutions, Inc., 194 F.3d 980 (9th Cir. 1999); Petroliam Nasional Berhad v. GoDaddy.com, Inc., 737 F.3d 546 (9th Cir. 2013). The practical consequence is that the registrar is almost always more useful as a cooperating witness and the recipient of a court order than as a defendant.

rl.com and the downstream buyer

The hardest theft cases involve a name that has been sold after the theft. In CRS Recovery, Inc. v. Laxton, 600 F.3d 1138 (9th Cir. 2010), a valuable two-letter name, rl.com, was hijacked after its registrant let the separate domain that hosted his contact email address lapse. A stranger registered that email domain through a Beijing registrar, used the address to transfer rl.com to himself, and the name passed to a buyer in India and then to a California resident who paid $15,000 for it. The Ninth Circuit agreed that California law, under which domain names are property, governed the conversion claim, finding no true conflict with the law of Virginia, where the registrar sat. But it reversed summary judgment for the original owner's assignee because disputed facts remained, including whether the owner had abandoned the name by letting the email domain lapse, and remanded. The opinion is worth reading in full before litigating a resale case, both for its choice-of-law discussion and for its treatment of the buyer's position. The general principle it reflects is old: a thief cannot pass good title, so a buyer from a thief usually takes nothing, though the buyer's good faith can affect remedies and the claims available against the buyer personally.

The legal paths, in the order they usually matter

The paths are not alternatives you choose among once. They are layers, and a well-run recovery often uses three or four of them at once. The table summarizes them; the sections that follow explain each.

Path Who starts it Needs a trademark? Needs the thief's identity? Typical time Typical cost
Registrar cooperation and transfer reversal Victim asks; registrars agree No No Days to weeks Low
Transfer Dispute Resolution Policy (TDRP) Victim's registrar files No No Weeks to a few months Filing fee plus registrar time; registrars may pass costs on
UDRP complaint Victim Yes (registered or common law) No About 45 to 60 days Provider fees plus counsel
In rem ACPA action Victim Yes No (that is the point) A few weeks for a TRO; a few months for judgment by default Several thousand to tens of thousands of dollars
In personam ACPA, conversion, CFAA, SCA Victim ACPA yes; others no Yes Months to years Significant
Criminal referral Victim reports; prosecutors decide No Investigators find it Unpredictable Low to the victim
Purchase through escrow Victim negotiates No No Days The price, plus risk

Path 1: The registrars and the Transfer Policy

ICANN's Transfer Policy governs how a name moves from one registrar to another. Under the version in force for most of the past decade, the gaining registrar receives a transfer request with the auth code, the losing registrar has a short window (five days) to deny it on permitted grounds, and the transfer otherwise completes automatically. Registrars may deny transfers in specified situations, including evidence of fraud and a pending dispute, and a registrar may refuse to transfer a name within 60 days of its registration or of a prior transfer, though registrars apply that restriction inconsistently. A change of registrant (a material change to the registrant's name, organization, or email) triggers a 60-day transfer lock unless the registrant opts out. Thieves learned to opt out.

A revision is on the way. In March 2025, ICANN's GNSO Council approved all 47 recommendations of its Transfer Policy Review working group. They include renaming the auth code the Transfer Authorization Code and limiting its validity to 36 hours, eliminating the gaining registrar's Form of Authorization, setting a mandatory 30-day restriction on transfers after initial registration and after an inter-registrar transfer, and replacing the 60-day change-of-registrant lock with a notice to the registrant within 24 hours of the change. The recommendations take effect only after ICANN Board adoption and an implementation period that the Council expected to run about 18 months, so the current policy governs in the meantime. Check which version applies on the date of the transfer you are challenging.

Two features of the Transfer Policy matter most to a theft victim.

The Transfer Emergency Action Contact. Every registrar must designate a Transfer Emergency Action Contact (TEAC) for urgent communications from other registrars about transfers, and must respond within four hours under the current policy. The victim cannot use the TEAC directly. The victim's registrar can, and a registrar that receives credible evidence of a hijacked transfer within the first days often uses it to ask the gaining registrar to reverse the transfer. A registrar that fails to respond to a TEAC communication risks having the transfer reversed.

Voluntary reversal. Registrars can and do agree to undo transfers. A gaining registrar that sees a newly created account, a mismatch between payment details and the registrant, and a credible report of theft from a well-known registrar has every incentive to cooperate. The leverage is the losing registrar's escalation and the gaining registrar's own terms of service, which almost always prohibit fraudulent registrations.

A victim cannot force any of this. What the victim can do is give the registrar what it needs: proof of prior registration, proof of identity and authority, a clear timeline, and evidence of the unauthorized access. The toolkit in Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints includes a registrar demand letter and an evidence-of-ownership declaration built for this purpose.

Path 2: The Transfer Dispute Resolution Policy

When registrars disagree about whether a transfer was proper, the TDRP provides a formal process. Its defining feature, and its main limitation, is that only a registrar may file. The victim's former registrar files a request with an ICANN-approved dispute resolution provider, the gaining registrar responds, and a panel decides whether the transfer violated the Transfer Policy. The remedy is reversal of the transfer, or denial of the request. Revisions that took effect in 2016 removed the registry as a first-level decision-maker, so filings now go to the dispute providers. A request generally must be brought within twelve months of the alleged violation.

The TDRP is narrow. It asks whether the transfer complied with the Transfer Policy's procedures, not who owns the name in some broader sense. A transfer that was made with a valid auth code obtained through account compromise may look procedurally proper. Panels have nonetheless looked at whether the person who authorized the transfer was in fact the registrant or someone with authority, which is where evidence of the compromise matters. And because the victim depends on the registrar's willingness to file, the victim's job is to make that decision easy: provide the evidence, offer to cover the fees if the registrar asks, and explain why a reversal serves the registrar's own interest in protecting its customers. The Recovering a Hijacked Domain Name: A Practical Guide walks through the timing.

Path 3: The UDRP, used against a thief

The Uniform Domain-Name Dispute-Resolution Policy is built into every generic top-level domain registration agreement. A complainant must show three things: that the domain is identical or confusingly similar to a trademark in which the complainant has rights, that the registrant has no rights or legitimate interests in the name, and that the name was registered and is being used in bad faith. The remedy is transfer or cancellation. For the mechanics, see How to File a UDRP Complaint for Domain Name Disputes.

In a theft case, the second and third elements are usually the easy ones. A person who acquires a domain by breaking into someone else's account has no legitimate interest in it, and panels applying the consensus views summarized in the WIPO Jurisprudential Overview 3.0 treat the current registrant's acquisition as the relevant "registration" for bad-faith purposes. Obtaining a name through unauthorized access to the owner's account is about as clear an example of bad faith as exists. Listing it for sale to the public, or offering it back to the owner, reinforces the point.

The hard element is the first. The UDRP protects trademarks, not registrations. A business that has used its domain as its name for years usually has at least common law trademark rights, which the UDRP accepts if the complainant proves them with evidence of use and recognition. A domain investor who held a short, generic, or dictionary-word name as an asset usually has no trademark at all, and the UDRP is closed. Practitioners sometimes see complaints by such investors framed around the name itself as a mark. Panels are skeptical, and a weak first-element showing can turn a theft victim into a losing complainant.

Three further cautions apply.

Country-code domains (.us, .uk, .de, .io, and others) follow their own registries' policies, some of which mirror the UDRP and some of which do not. For those, see Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking. The Uniform Rapid Suspension System is rarely useful in theft cases, because it suspends rather than transfers, which leaves the victim without its name.

Path 4: The in rem ACPA action

The in rem provision, 15 U.S.C. § 1125(d)(2), lets the owner of a mark file a civil action against the domain name itself in the judicial district where the registrar, registry, or other domain name authority that registered or assigned the name is located. Its requirements, in plain terms:

  1. A mark. The plaintiff must own a mark registered with the Patent and Trademark Office or protected under section 43(a) (unregistered marks) or section 43(c) (famous marks).
  2. A violation. The domain must violate a right of the mark owner under section 43(a), 43(c), or the ACPA's bad-faith provision. Harrods confirms that infringement and dilution count, not only cybersquatting.
  3. No defendant to sue. The court must find that the plaintiff cannot obtain personal jurisdiction over a person who would have been a defendant in an ordinary ACPA case, or, through due diligence, was not able to find that person. Due diligence means sending notice of the alleged violation and the intent to proceed in rem to the postal and email addresses the registrant provided to the registrar, and publishing notice as the court directs.
  4. The right court. The district where the registrar, registry, or other domain authority is located. For .com and .net, Verisign's location in Reston makes that the Eastern District of Virginia, Alexandria Division.

The remedies are limited to forfeiture, cancellation, or transfer of the name. There are no damages in rem. Once the registrar or registry receives written notice of a filed, stamped complaint, the statute requires it to deposit with the court documents establishing the court's control over the name and to refrain from transferring, suspending, or otherwise modifying the name during the case except on court order, 15 U.S.C. § 1125(d)(2)(D)(i). That provision is a statutory freeze. In a theft case, it can be worth more than the judgment.

Why does the in rem action fit theft so well? Because the thief is, almost by definition, a person the plaintiff cannot find or cannot reach. The name is usually registered through a privacy service at an offshore registrar, the registrant contact data is false, and the thief has no reason to appear. In rem proceedings in the Eastern District of Virginia typically move by notice, publication, entry of default under Fed. R. Civ. P. 55, and a default judgment ordering Verisign to change the registrar of record back to the plaintiff's chosen registrar. The default process is explained in Default and Default Judgment in Federal Court: Rules 55 and 60 and the Cost of Ignoring a Lawsuit.

The important twist for theft cases: the registry is a domestic party that obeys court orders even when the registrar of record is overseas and unresponsive. Verisign does not need the foreign registrar's cooperation to change the sponsoring registrar in the .com database. That is the point at which the court's power over the "thing" becomes real.

For pleading templates, see the in rem complaint skeleton in Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints and the cybersquatting-oriented pleadings in Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses.

Emergency relief in the in rem case

Waiting the weeks it takes to complete notice and publication can be costly if the thief is actively selling the name or using it to phish the victim's customers. Plaintiffs therefore often pair the complaint with a motion for a temporary restraining order under Fed. R. Civ. P. 65(b), asking the court to direct the registry to lock the name, to disable its resolution, or (less often at the TRO stage) to return it to the plaintiff's registrar. The standard is the familiar one from Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008): likely success, likely irreparable harm, balance of equities, and the public interest. Loss of control over a business's domain, its email, and its customer trust is a strong irreparable harm showing, and the statutory freeze in section 1125(d)(2)(D) supports an order preserving the status quo. Ex parte relief requires specific facts in a declaration showing immediate and irreparable injury and the attorney's certification of efforts to give notice; it expires in fourteen days unless extended, see also Granny Goose Foods, Inc. v. Brotherhood of Teamsters, 415 U.S. 423 (1974). The Eastern District of Virginia has issued ex parte orders directed at registries in large-scale cases, including Microsoft's 2010 action against the Waledac botnet's command domains, which shows the court's familiarity with the mechanics. For the general framework, see Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court.

What if the victim has no mark?

This is the largest gap in the system. The ACPA's in rem action is a trademark remedy, so the owner of an investment name or a personal name with no commercial use cannot invoke it. (Personal names have a separate, narrow remedy under 15 U.S.C. § 8131, but it reaches registration with intent to profit by selling the name, and it is not in rem.) Owners in this position have tried several approaches:

  • Quiet title or conversion in the registry's district. The theory is that a domain is property located where the registry is (borrowing Office Depot), and that a federal court sitting in that district may adjudicate claims to property within the district against absent defendants under 28 U.S.C. § 1655, which authorizes actions to remove a "cloud upon the title" to property within the district where a defendant cannot be served there. That theory requires a basis for subject matter jurisdiction (diversity, or a federal claim to which state claims are supplemental under 28 U.S.C. § 1367), and it runs into Umbro if Virginia law governs whether the name is property. Treat it as available but unsettled.
  • A John Doe action against the thief. Sue the unknown hijacker for conversion and computer-crime claims, seek early discovery from registrars, email providers, and payment processors, and ask for an injunction that the registry or registrar is then asked to honor. The identification process is described in Identifying an Anonymous Defendant Online: A Practical Guide.
  • State-court proceedings in the registry's state. Some lawyers have used state procedures where the registry sits. The Umbro holding limits creditor remedies there, and the approach is less tested.

Path 5: Claims against the thief, the buyer, or the insider

When the thief can be found, or when the name is in the hands of an identifiable buyer or former insider, ordinary in personam litigation opens up.

ACPA (in personam). Under 15 U.S.C. § 1125(d)(1), a person who, with a bad-faith intent to profit, registers, traffics in, or uses a domain name that is identical or confusingly similar to a distinctive mark is liable. Remedies include transfer, injunctive relief under 15 U.S.C. § 1116, and either actual damages or statutory damages of $1,000 to $100,000 per domain name under 15 U.S.C. § 1117(d). A thief who lists the stolen name for sale has trafficked in it with an intent to profit.

Conversion and trespass to chattels. Where state law treats domain names as property, conversion lies against the thief and, potentially, against anyone who exercises dominion over the name inconsistent with the owner's rights. Trespass to chattels is a lesser claim that, under California law, requires actual injury to the chattel or the owner's interest in it, Intel Corp. v. Hamidi, 71 P.3d 296 (Cal. 2003). It is mostly useful against someone who interfered with the name temporarily (a DNS hijack) rather than took it.

Computer Fraud and Abuse Act. A person who accesses the victim's registrar or email account using stolen credentials accesses a protected computer "without authorization." The Supreme Court in Van Buren v. United States, 593 U.S. 374 (2021) narrowed the separate "exceeds authorized access" prong to a gates-up-or-down inquiry, but outright credential theft is the central case of access without authorization, and the Ninth Circuit held that using someone else's password after one's own access was revoked qualifies, United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016). The civil action under section 1030(g) requires one of the statutory harms, most often a "loss" of at least $5,000 in a one-year period, and it must be brought within two years of the act or the discovery of the damage. Loss includes the reasonable cost of responding to the offense, assessing the damage, and restoring systems, so the forensic and remediation bills in a hijacking count. For the CFAA's broader contours, see Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims.

Stored Communications Act. A thief who logs into the victim's email account to intercept password reset messages and reads stored mail has intentionally accessed a facility through which an electronic communication service is provided without authorization and obtained access to communications in electronic storage. 18 U.S.C. § 2701. The civil remedy in 18 U.S.C. § 2707 provides actual damages (with a statutory minimum of $1,000), punitive damages for willful violations, and attorney's fees, with a two-year limitations period. On what counts as electronic storage for email left on a provider's server, see Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004).

Contract and agency claims against insiders. A developer, agency, or employee who registered the client's domain in its own name is usually the client's agent for that purpose. The Restatement (Third) of Agency treats an agent's duty to account for and deliver property acquired on the principal's behalf as basic. An engagement agreement that says so expressly turns a dispute into a breach claim, and many disputes end when the agreement is quoted back to the developer. Where the developer is holding the name to extract payment, ACPA liability may also be available if the name matches the client's mark: offering to transfer a domain for financial gain without having used it for a bona fide offering of goods or services is one of the statutory bad-faith factors.

Path 6: Law enforcement

Domain theft is a crime. Depending on the facts, it can involve computer intrusion under 18 U.S.C. § 1030, wire fraud under 18 U.S.C. § 1343, aggravated identity theft under 18 U.S.C. § 1028A when the thief used another person's identity to commit the fraud, and state computer-crime and theft statutes. Reports go to the FBI's Internet Crime Complaint Center (IC3), to a local FBI field office for significant losses, and to local police where a police report is needed for insurance or registrar purposes.

A criminal referral rarely produces the domain quickly, and the victim should not pause civil recovery while waiting. But it has three benefits. Law enforcement can obtain records the victim cannot, including the content and subscriber information that providers may not disclose to private parties under 18 U.S.C. § 2702 and 18 U.S.C. § 2703. A conviction brings mandatory restitution for many property and fraud offenses under 18 U.S.C. § 3663A. And a report number is often what an insurer or a reluctant registrar wants to see. Crime victims' participation rights are covered in Crime Victims' Rights: Notice, Participation, Restitution, and Compensation.

Path 7: Buying it back

Many victims are tempted to pay. Sometimes it is the right business decision, especially when the name is generic, the victim has no mark, and the thief's price is modest. But three risks deserve attention before anyone wires money.

  • The seller may not be able to deliver. Pay only through a reputable domain escrow service that releases funds after the name is in the victim's account. Never pay a stranger directly.
  • Paying the thief funds the next theft and may not be lawful. If the seller is or acts for a person on the Treasury Department's sanctions lists, payment can violate U.S. sanctions regardless of the victim's intent; the Office of Foreign Assets Control administers cyber-related sanctions under 31 C.F.R. Part 578 and reporting rules under 31 C.F.R. Part 501. The risk for a domain buy-back is usually low, but the analysis is the same one companies run for ransomware payments. See Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers.
  • A purchase can undercut later claims. A negotiated purchase from a downstream holder who claims good faith may resolve the matter. A payment to the thief, made without preserving the record, can complicate the narrative in later litigation and in insurance claims. Document everything, and tell the insurer first.

Splits and open questions

Does a thief's acquisition count as a "registration"? The ACPA asks whether the defendant "registers" a name in bad faith. The circuits split on whether a later re-registration counts. The Ninth Circuit in GoPets Ltd. v. Hise, 657 F.3d 1024 (9th Cir. 2011) held that a re-registration by the original registrant's transferee was not a "registration," reasoning that the original registrant's rights should be freely transferable. The Third Circuit in Schmidheiny v. Weber, 319 F.3d 581 (3d Cir. 2003), the Eleventh Circuit in Jysk Bed'N Linen v. Dutta-Roy, 810 F.3d 767 (11th Cir. 2015), and the Fourth Circuit in Prudential Insurance Co. of America v. Shenzhen Stone Network Information Ltd., 58 F.4th 785 (4th Cir. 2023) read "registration" to include later acquisitions. The split matters mostly in cybersquatting cases, where an old registration can predate the plaintiff's mark. In a theft case, GoPets's premise (the transferee steps into the shoes of an owner who had rights) does not fit: the thief received nothing from the true owner, so even a Ninth Circuit court should be receptive to treating the theft as a new registration. No appellate court has squarely decided the point in a theft case. Plead the theft as a registration and, in the alternative, as trafficking and use.

Is a domain name property everywhere? No. Kremen says yes under California law; Umbro says that in Virginia a registration is a contract for services, at least for garnishment. Other states have not all spoken. Bankruptcy courts routinely treat domain portfolios as estate property, and courts have ordered them sold, which suggests the practical answer is converging. But the choice of law still affects whether a conversion claim is available and whether a court may treat the name as a res for state-law purposes.

What does a good-faith buyer get? The common law answer is that a thief conveys no title, but buyers raise estoppel, laches, and abandonment, and some argue that the registrar's terms make the registration a contract that the registrar validly transferred. CRS Recovery rejected an abandonment argument on its facts. The buyer's remedy is usually against the seller. Expect the buyer to fight harder than the thief would have, and expect the case to turn on what the buyer knew (a price far below market and a seller with no history are red flags).

How far does the registrar's immunity reach? Section 1114(2)(D) and Rigsby protect registrars for registration activity and for good-faith compliance with policies and court orders. Whether a registrar that ignores obvious red flags in an inbound transfer (a newly created account, a mismatched payment card, an auth code used from an unexpected country) can be liable for conversion under Kremen is less clear. Registrar terms of service limit liability and require arbitration, and courts have enforced those terms. The practical stance remains: treat the registrar as an ally, document its responses, and keep the liability theory in reserve.

Will the new Transfer Policy help or hurt? The recommended policy's shorter-lived transfer codes and notice requirements should make silent theft harder. Its replacement of the 60-day change-of-registrant lock with notification could cut the other way, since a thief who changes the registrant and transfers quickly faces fewer automatic obstacles. Whether the revised TDRP and registrar practices fill the gap is an open question.

Practical implications for each participant

For the victim business. Treat the first 72 hours as an incident, not a legal dispute. Contact the registrar's abuse and security teams, document everything, change every credential connected to the domain, and notify the insurer. Decide quickly whether you have a trademark, because that decides whether the UDRP and the in rem action are available. If the name has left the original registrar, push the registrar to use its emergency transfer contact and, if needed, the TDRP. If the thief is selling the name or using it to phish customers, file in rem in the registry's district with a TRO motion. The step-by-step sequence is in Recovering a Hijacked Domain Name: A Practical Guide, and the tasks are in Domain Name Security and Recovery Checklist: A Practical Checklist.

For the domain investor without a mark. Your fastest tools are the registrars and law enforcement, and your litigation options are conversion and computer-crime claims against an identified thief or a quiet-title theory in the registry's district. Keep registration records, purchase documents, and account history for every valuable name, because proof of ownership is your whole case.

For the registrar. Respond to TEAC requests on time, preserve logs (login IPs, account changes, auth code requests, payment details), and document your fraud review. A registrar that acts quickly on credible evidence protects its customers and its accreditation, and the safe harbor in section 1114(2)(D)(i) protects transfers made in compliance with a court order or a reasonable policy.

For the downstream buyer. If you bought a name that turns out to have been stolen, do not escalate. Preserve your purchase records, notify your seller and the escrow service, and evaluate whether you are better off returning the name in exchange for a release than defending an in rem or conversion case. Your claim is against the person who sold it to you.

For the web developer or agency. If you hold client domains, hold them as the client's agent and say so in writing. Using a client's domain as leverage for an unpaid invoice is a fast way to turn a fee dispute into an ACPA or conversion claim against you. Register client names in the client's own registrar account, or transfer them on request.

For the trademark owner abroad. If your mark is registered outside the United States but not here, you may still have a section 43(a) claim based on U.S. use, and the UDRP accepts trademarks registered anywhere. On building the foreign portfolio that supports those claims, see Global Trademark Portfolio Toolkit: Filing Matrices, Bad-Faith Registration Responses, and Watch Programs.

An extended worked example

Harbor & Pine Coffee Roasters, LLC, an Oregon company, has sold coffee online at harborpine.com since 2014. It has a federal registration for HARBOR & PINE for coffee and online retail services. Its founder, Mara Quist, registered the domain in her own name at a large U.S. registrar, with her personal Gmail address as the registrant contact and SMS codes for two-factor authentication.

Day 0, Friday night. Mara's mobile carrier receives a request to port her number to a new SIM, which the carrier approves after the caller answers security questions with information available online. Within an hour, the thief resets Mara's Gmail password using SMS recovery, resets her registrar password through Gmail, disables the registrar lock, requests the auth code, and initiates a transfer to a registrar based in Southeast Asia. The thief also creates a mail filter that deletes messages from the registrar.

Day 1, Saturday morning. The site and email are down. Mara discovers that the transfer has been initiated but, because the old registrar's process gives it a few days to act, has not yet completed. This is the best possible moment. MC Law's advice to her: call the registrar's security line, not general support; ask that the transfer be denied under the Transfer Policy's fraud ground; ask for the account to be frozen; and get the case number in writing. She does. The registrar denies the pending transfer.

Suppose instead that the thief had been faster, or the registrar slower, and the transfer completed on Saturday. The rest of the example follows that harder path.

Day 1 (alternate), Saturday. The name now sits at the foreign registrar, with a privacy service as registrant. Mara regains her phone number from the carrier, secures Gmail with a hardware key, and changes every password. She files an IC3 complaint and a local police report. Her lawyer preserves evidence: a capture of the current RDAP record, the registrar's transfer notices (recovered from Gmail's trash), the Gmail security log showing the new login, carrier records of the port request, the Internet Archive's captures of the site, and the company's registration certificate. Each item goes into a log with a hash value, because authentication under Fed. R. Evid. 901 will matter if the case goes to court.

Day 2, Sunday. The lawyer sends the original registrar a short demand with an ownership declaration, asking it to contact the gaining registrar through the TEAC and request reversal. The registrar does so on Monday morning.

Day 4, Tuesday. The gaining registrar does not respond. Meanwhile harborpine.com appears on a domain marketplace with an asking price of $45,000, and the thief's copy of the site begins collecting customers' card details. The original registrar agrees to file a TDRP request but warns that the process will take weeks.

Day 5, Wednesday. Because customers are being phished and the name could be sold to a buyer who claims good faith, Harbor & Pine files an in rem complaint in the Eastern District of Virginia against harborpine.com under section 1125(d)(2), alleging infringement and cybersquatting, together with a motion for a TRO directing Verisign to lock the name and disable its resolution pending the case. The declaration explains the SIM swap, attaches the evidence log, and documents the notice sent to the registrant's listed email and to the privacy service. The court grants a TRO the following day. Verisign locks the name and places it on hold, which stops the phishing and makes the marketplace listing unsellable.

Weeks 2 to 6. Notice is published as the court directs. No one appears. The clerk enters default, and the court enters a default judgment ordering Verisign to change the registrar of record to Harbor & Pine's chosen registrar, where the name goes into a company-owned account with registry lock. The TDRP request is withdrawn as moot.

Afterward. Harbor & Pine's cyber policy covers part of the legal and forensic costs, after the insurer's panel counsel confirms that the notice was timely. The company's lawyer sends the carrier a letter preserving claims under the FCC's SIM-swap rules and state law. An identified suspect is later charged in an unrelated federal SIM-swap case, and the company submits a restitution request with its loss documentation.

What changed the outcome. Three things: speed on day one; a federal trademark registration, which opened the in rem path; and an evidence file built for court from the start. Without the registration, Harbor & Pine would have relied on common law rights (which would have worked for the UDRP but required more proof) and lost a few days. Without any mark at all, it would have been left with the registrars, a John Doe suit, and law enforcement.

Common mistakes

  • Calling general support instead of the security or abuse team. Frontline agents read scripts. Ask for the registrar's abuse, fraud, or domain security team, and put every request in writing.
  • Changing nothing else. If the thief still controls the email account or phone number, the recovered name will be taken again. Secure the root credentials first.
  • Filing a UDRP complaint without a mark. A theft victim with no trademark loses the UDRP and wastes weeks.
  • Filing in rem in the wrong district. In rem jurisdiction lies only where the registrar, registry, or other domain authority is located. For .com and .net, that means the Eastern District of Virginia regardless of where the plaintiff or the thief lives.
  • Paying the thief directly. Use escrow, check sanctions exposure, and talk to the insurer before paying anything.
  • Ignoring the inside job. When a former developer or employee holds the name, an engagement letter and a calm demand often resolve it in a week. A cybersquatting complaint against a former vendor can backfire as reverse domain name hijacking if the vendor had a plausible claim.
  • Letting the domain portfolio drift back to old habits. The registrant email address, the registrar account owner, and the two-factor method that allowed the theft should all change permanently.

Frequently asked questions

Is it really theft if the thief used my own password? Yes. Using stolen credentials to access an account is access without authorization under the CFAA and the Stored Communications Act, and transferring the name without the owner's consent is conversion where domain names are property. The fact that the registrar's process recorded a valid code shows only that the thief had the code.

Can I make the new registrar give the name back? Not directly. Your registrar can ask it through the Transfer Emergency Action Contact and, if needed, file a TDRP request. A court order directed at the registry is the tool that works when the gaining registrar will not cooperate.

Do I need a trademark to get my domain back? Not for registrar recovery, law enforcement, or state-law property claims against an identified person. You do need one for the UDRP and the ACPA in rem action, which are often the fastest formal tools.

My developer registered our domain in his name. Is it his? Probably not, if he did it as part of building your site and you paid for it. He likely registered it as your agent. Look at the engagement terms, collect the invoices, and make a written demand. A domain registration is not a copyrightable work, so the work-made-for-hire rules do not decide it either way.

How long does an in rem case take? With a TRO, the name can be frozen within days. A default judgment ordering transfer usually follows the notice and publication period, often within two to three months in the Eastern District of Virginia. A contested case takes longer.

Will the registrar be liable? Rarely. The Lanham Act protects registrars that act without bad-faith intent to profit and those that comply with court orders, and courts have rejected contributory liability theories. Kremen shows that a registrar that hands over a name on obviously fraudulent instructions can face conversion liability, but registrar terms of service and arbitration clauses complicate that claim.

Should I report the theft to the FBI? Yes, through IC3, and also to local police if your insurer or registrar wants a report number. Do not wait for law enforcement before pursuing civil recovery.

Takeaways

  • Diagnose first: account takeover, email compromise, SIM swap, insider, lapse, or DNS hijack. Each points to a different remedy.
  • Act in the first hours, through the registrar's security team, before the transfer completes or the name moves again.
  • A trademark opens the UDRP and the in rem ACPA action; without one, rely on registrars, John Doe litigation, property claims, and law enforcement.
  • The in rem action in the registry's district, paired with a TRO directed at the registry, is the strongest court tool against an anonymous thief.
  • Domain names are property in California after Kremen; Virginia treats a registration as a service contract for garnishment. Plead accordingly.
  • Prevention is the cheapest remedy: registry lock, hardware-key authentication, company-owned registrar accounts, and a registrant email on a domain the company controls.

This document is general information, not legal advice for any particular situation; the law changes, ICANN policies are being revised, and the facts matter.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits