Quite right, whois should be correct before any payments for any sale.
The part about privacy protected , not everyone can agree to it ( I got no prob.
) some people may not want to make whois public.
If it's privacy protected , one can't reply from an address such as
domainname.ext @ SomePrivacyProtect.extension 
Simple solution is to send an email with some code/anything to the listed email address (even if privacy protected most registrars either forward the email to the domain owner or provide means to send the owner a message ) and ask the seller to confirm code/message via pm.