Maybe it's not the case for all TLDs and registrars, but for my .se domain and my specific registrar, changing any of the contact records required a confirmation sent to the e-mail address of the owner record. A logical safety measure to prevent theft.