Actually, the domain had been transferred to a new registrar a month prior to this incident.

It was paid for a full year, beginning a month before this incident.

Succinctly, you are wrong.

But if you would like, here is an analogy:

Your electric company wants to make sure your phone number is accurate, so your electrical company calls a number on the account, and unless you answer, they shut off your electricity. Your bill is paid, but they cannot verify your phone, so your power gets cut off.

...and all you have is cordless phone, which won't work without electricity.

So, you have to go to the power company to change the phone number on the account to your brother's phone, and then verify using his number to get your electricity turned back on.