To add additional security to your domain and protect against unauthorized transfers, you can add Domain Locking to lock your domain. Locking your domain ensures that an authorization code (EPP code) can not be generated for the domain, which is required to transfer your domain to another provider.
Adding Domain Locking to your domain is the best way to ensure you are the only one who has control to make changes to your domain.
Currently if your domain is not locked, the following steps are used to transfer a domains:
A domain transfer is requested by another registrar. This request can be initiated by anyone, whether or not they own your domain.
An email is sent to the administrative contact for your domain, requesting approval for the transfer.
If no response is received within five days, the domain automatically transfers to the new registrar.
You can see that if you do not receive the email, or if you are out of town, etc, it would be very easy for your domain to be transferred away without your knowledge or intervention.
With Domain Locking active and a domain transfer is requested (step 1, above) the new registrar checks to see if the domain is locked. If it is, the email from step 2 is never sent, and the domain transfer stops.