What is a Transfer code?

The password (EPP or auth code) that moves a domain between registrars.

To move a domain you unlock it, get the code from the old registrar and give it to the new one. The code is as sensitive as a password: with it and an unlocked domain, anyone can take the name.

Registrars email it to the contact on file; keep that contact current.

What to do

Only request the code when you are moving.
Never send it to someone who asked for it by phone or email.
Re-lock the domain after the transfer completes.