You must go into your control panel of your website to find the domain locking area. If it cannot be found you must contact your support. When your domain is locked, you'll be substantially protected from unauthorized third parties who might try to misdirect your name servers or transfer your domain without your permission.

Overlooking domain names is icann.org and the rules of this are there. The FAQ section has a good start with internal links about transfers. They have the updated legal and technical requirements about transfer notification requirements and times.

To check you expiration dates and who registered your domain go to whois.net. Then from there you can check the web address of the registrar. Sometimes your hosting works with another company to register the domains. This way you can keep track of what is going on much closer.

When you want your hosting to initiate a registrar transfer or modify your name servers you'll have to unlock or sometimes they will do it for you as the process is completed. The transferring of domains is more secure than ever as long as the domain is locked under normal use and unlocked for your transfers.

Another trick in the bag is fake renewal of web hosting reminders or domain registration expiration notices. Always use a very private e-mail address when signing up for hosting, never using it for anything but the most important e-mail.

If your getting any amount of spam currently create a new account somewhere using a common well know e-mail carrier that has a high priority on security. This way the spam is at a minimum and check all messages including the spam bin which good messages can go in sometimes, which I found this out by accident.

Some e-mail services may have automatic deletion of spam messages, turn this off so you get all messages. This way if a transfer is being attempted, your hosting service is supposed to notify you and you'll get the message.

Never click a link in an email no matter who it is to login somewhere. Phishing is where a fake email of some company you normally deal with comes into your e-mail box hoping you login to their fake site by clicking the link. I get notices a lot, after double checking I find they are fake. I clicked on a my bank e-mail and logged in without thinking, luckily it was a real e-mail.

Always open up a new browser window and go there yourself. This goes for messages from your hosting service. The fake e-mails look just like real emails with copied logo and formatting.

Sometimes an owner of a site will register their website using their internet service provider's e-mail system. Then they switch internet service providers and lose the old e-mail. They forget to put in a new email with their website hosting. Then if there is a notice of a transfer attempt it would never be known. I read there is a 5 calender day period to respond to a transfer request but I am not sure if locking alters this period or not.

Another thing is having a good well known hosting service that will notify you as they should if anything changes with the service and transfer attempts.