[lingben]

Here are 3 simple changes that can prevent this:

* use 2 factor authentication (if your registrar doesn't find one that does or better yet, have ICANN rule that all registrars must have it)

* ICANN rule that says if a domain has been recently moved it can be frozen by previous owner until the matter is cleared up

* whois privacy will not only hide who the owner of the site is but also who the registrar is (if you don't know who the registar is among the hundreds out there, you can't target the right one with social engineering!)