In this case, it looks like the "target" registrar is wise to them
Not really, it's SOP (as laid out by ICANN & co.) to ask the owner of the domain to verify the transfer.
Which reminds me of another tip: keep you domain contact details up-to-date! In my case I have the owner details showing my client info (in case someone wishes to sue them for something!) and the tech contact info as myself to intercept the type of messages as above.
Having said that, one of my clients got fleeced over 70 notes (GBP) by DoA - she paid what she thought was an invoice (except that that they have complied with a court ruling and print a small "
this is advertissement" message on their letters)
amofw