question regarding domain owner transfer method - security
I am in the process of purchasing a domain name from another person. I am using Escrow.com for the transaction to ensure a secure process.
The current owner has it registered with Galcomm. His suggestion for transferring the domain name is:
He will change the WHOIS information to my name. He would then give me the ID and PASSWORD for the Galcomm account to manage it and change the password.
I am concerned about possible security issues. For example, him being able to reclaim the account and then the domain after the purchase.
I emailed Galcomm and asked about this. Their suggestion was for me to open an account at Galcomm and ask the seller to transfer the domain to my Galcomm acount using the 'set domain to new user' function in his domain management area. Also, he would then need my login and password for my Galcomm acount during this process.
Once the process is complete I could change the password back. My concern with this is that once he has the password he can change all the information in the account and hijack my account. So, either way I left in a rather unsecure position.
Can anyone offer any advice, opinion or suggestions on how I might best proceed with this? Many thanks eveyone.
I have never used escrow but i was sure that the point of using it was that the money would be sent to escrow, that the domain would be transfered to escrow and that escrow would then give the domain to the buyer and the money to the seller... or am i wrong.
You are correct. Escrow.com will hold the funds until the transaction is complete. My concern, however, is that using the 2 suggested methods that the seller may have the ability to take back ownership of the domain from me. I, of course, don't want to be the victim of fraud/theft.
1) Create 2 new galcomm account's "dummy" and "real"
2) Get seller to transfer to "dummy" account
3) take control of the domain in that account, change passwords etc
4) you transfer from "dummy" account to "real" account
5) Once domain is in your 2nd account release the escrow funds
This way the seller will only know about the first account details. If you really want to go beyond safe you can create the dummy account with some throw away info eg new hotmail address, password that is in no way similar to password on other account, if they have a security question fill it will meaningless info (but keep a note of what you put until domain is in real account, just in case :-)
When using Escrow.com, the buyer pays first. Then once the funds are secured, Escrow instructs the seller to submit the domain to the buyer. That means you will get the username/password at that point. Depending on the number of "inspection days" you agreed to at the beginning, you will be able to "hold" onto the domain, change the password etc. Once everything is ok (within the aforementioned inspection period) you will confirm it to Escrow.com and then they release payment to the seller.
Thanks for all your advice everyone. I went the dummy account route. I am now in the process of waiting for them to transfer to the real account. I have to wait the 60 days from when it was 1st registered with them before I can transfer to another registrar. Will be happy when all is said and done. Phew! =)