&gt;&gt;Isn&#x27;t 2FA standard nowadays.<p>Some don&#x27;t appear to have it at all (1&amp;1), some offer an option to SMS a code (godaddy&#x2F;namecheap), a few offer integration with something like Authy&#x2F;Google Auth.<p>&gt;&gt;And it still does not disable social engineering as attack option.<p>It&#x27;s better than what I see from other registrars.  It is not perfect.  You, of course, are in control of the answers to the challenge questions, they don&#x27;t have to be the truth.