The aeDA registry does not enforce a lock mechanism on .ae domains. Once a .ae is requested for transfer, the domain will move to the gaining registrar within 3 days regardless of the lock status at the losing registrar. Make sure you enable 2FA on your domain registrar account to avoid unauthorized access to your domains.
WARNING: When buying a domain from another party, make sure you update the contact information on the domain record the moment you receive the domain. When .ae’s are transferred, they retain the previous owner’s information (including email) and do not inherit the information from the gaining registrant’s account. The previous owner could access the registry’s tool at https://whois.aeda.net.ae/password_recovery/recover_password.jsp to maliciously get access to the new domain authorization code and start a transfer back to their account. When acquiring domains from another individual, ask your registrar to generate a new authorization code for your domain to prevent any hijacking attempts.