Rick reported this recently on his blog:

It appears GoDaddy.com gives you the option to cancel a transfer, after you have done an account change and the new owner has accepted the domain. How ludicrous is this? I’ve just had it happen a second time. Someone sends you a name, so you send them the money. The next thing they know, they pull it back! All they have to do is go to their account, go to pending account changes, check the box and click cancel. They can do this after it is finished!

Now in both cases it worked out fine because they had pulled it back because of a misunderstanding and quickly did another account change. It still leaves a huge door open for fraud.

I’m sure other registrars would let you pull back a domain as well, after you’ve pushed it.

I suppose it’s been around for a while, but this is the first time I hear about that and this could be a serious problem. Another reason to avoid godaddy and to be extra cautious, especially when dealing with new people.