You might complain to Neustar at www.nic.us
Under Section 2.1.2 of their "Policy on Transfer of Sponsorship of Registrations
Between Reigstrars," it states:
a) Registrars must provide all Registered Name Holders with their unique “AuthInfo” code within five (5) calendar days of the Registered Name Holder’s initial request if the Registrar does not provide facilities for the Registered Name Holder to generate and manage their own unique “AuthInfo” code.
b) In addition, Registrars may not employ any mechanism for complying with a Registered Name Holder’s request to obtain the applicable “AuthInfo” code that is more restrictive than the mechanisms used for changing any aspect of the Registered Name Holder’s contact or name server information. Emphasis added.
c) The Registrar must not refuse to release an “AuthInfo” code to the Registered Name Holder solely because there is a dispute between the Registered Name Holder and the Registrar over payment.
d) Registrar-generated “AuthInfo” codes must be unique on a per-domain basis. The “AuthInfo” codes must be used solely to identify a Registered Name Holder.
So unless they make you call them to change the NameHolder's contact or nameserver information, they are in violation of paragraph (b) above.
Good Luck and, BTW, Welcome to the Forum