Usually social engineering the domain registrar into transferring the domain.
The answer he gave you was correct. The interpretation wasn't
I imagine it would be easier to socially engineer a cellphone store employee and get a SIM to do a SMS-based password reset for a Google/Microsoft/Apple email account than it would be to hijack my domain.