Security & Account Access

Yes. Three methods are available: SMS, an authenticator app (Google Authenticator or Authy are both recommended), and email, which stays enabled by default.

A transfer lock prevents a domain from being transferred to another registrar until it's turned off. It's highly recommended to leave your domain locked, since that's what helps prevent someone else gaining control of it. You'd only unlock it briefly when you're initiating a transfer yourself.

An account hold means something on the account needs review before certain actions can continue. NameBright doesn't publish a standard list of hold reasons or a fixed review timeframe, so the fastest way to find out what's going on and what needs to happen is to contact support directly.

A few immediate, concrete steps: change your password right away, check your Account Security Log for any logins or actions you don't recognize, and make sure two-factor authentication is turned on. If anything in the security log looks unfamiliar, or you can't get back into your account at all, contact support directly.

No. NameBright will never contact you in any way asking for your password.

Several layers work together: a transfer lock that has to be deliberately turned off before any transfer can start; auth codes that stay private to the account owner; a Transfer Out Security setting that lets you require your own approval, or set automatic rejection, before an outbound transfer completes; and two-factor authentication protecting the account itself.

A support code is a temporary code you generate from My Account > Security Settings > Support Code, then give to a NameBright support agent so they can access your account during a call. Treat it like a password: generate it right before you call, and reset or expire it from the same page once you're done.

Set a 4-digit PIN under My Account > Security Settings > Domain Delete. That starts a mandatory 48-hour waiting period, with no way to skip it, and once it ends you can use the PIN to delete a domain. This is only available on your primary account, not a delegate account, and deletion is permanent — if you just want a domain to stop renewing, turn off auto-renew instead.