Often they break into the registrars database and there is very little you can do. However, sometimes scammers also send you an email that your domain is up for registration then get you to switch over to them and then they reregister it in their name.