You, as a registrar, must initiate an investigation to determine whether an incorrect change of holder has taken place. You are required to retain documentation of all changes of holder, including for the purpose of investigating any potentially incorrect changes. If a domain holder reports that a change of holder has been carried out incorrectly, the retained documentation must be reviewed.
As a registrar, you may assess whether the domain name should be transferred back to the previous holder while the question of entitlement to the domain name is being investigated between the two parties involved.
Keep in mind that the new domain holder may have acquired the domain name in good faith. In such cases, you should not make a decision to reverse the change of holder yourself. Instead, you should refer the previous holder to the police if a crime is suspected, or advise them to have the dispute resolved in court.
