[oefrha]

Trust, but verify. In the TFA case at least, it shouldn’t be that hard to call the office’s number (not the filled out Google Voice number of course, but there has to be a number published by/available through reliable parties) and confirm “is it really your office who’s registering the domain”? if (printed on official letterhead) { return authorized; } is beyond stupid.

[cortesoft]

Right, but then you are trusting that number list... how is that generated? Can I call someone up and get that number changed?