They are trying to do a change of accounts, so they don't need auth. codes. But they do need access to the accounts. I assume they are doing it through some kind of keylogger / trojan on owner's computer.
When they weren't able to transfer any domains from my account, they proceeded to delete them ALL. 3,000 domains - deleted. But I was able to recover them.