Lots of good advice here. In our line of business, we often are taking over operations from other businesses, so we deal with this often.

#1 ) DO NOT let the domain expire.
#2 ) Call the official registrar directly. When in doubt, WhoIs.
#3 ) Expect them to require some sort of verification. Some registrars will require that they mail something to the postal address on file and you respond to it. Others will accept phone calls to registered numbers, followed by letters on letterhead with photos of driver's licenses.
#4 ) Typically this whole process takes ~3 weeks.