The usual tactic, known as domain slamming, is fairly basic – unethical companies mine WHOIS records for Registrant information and domain expiry dates. Then, months in advance, they contact the Registrant either by mail or email with a very official looking and sounding document or message that tells them to protect their valuable name by renewing early. A Google Images search brings up a couple of scanned examples.
Of course, when the Registrant sends the cheque or pays by credit card, thinking they are doing the right thing, what actually happens is that a Registrar transfer is initiated. The Registrant will then blindly go through the steps to complete the transfer, again thinking they are doing the right thing to protect their valuable domain name.
Combatting this is really fairly simple, a few recommendations for registrants: