If you look at the major domain name sales platforms, you will likely come across listings that aren’t legitimate. Sometimes a domain owner makes a typo when listing a domain name for sale, sometimes a domain owner has already sold a domain name and didn’t remove a listing, and other times people are simply messing around for whatever reason and list domain names they do not own. Domain name ownership verification still stinks on many platforms.
GDPR and Whois privacy are two issues that may cause verification issues. I believe most platforms have alternative methods of proving ownership though. In the case of domain names that were once owned by someone who listed a domain name for sale but later sold, I think it’s a pretty big challenge for sales platforms to be able to check the Whois or DNS records on millions of domain names every day to be sure listings remain valid.