Some gentleman from Singapore still owes me $100k from a transaction I carried out for him last year. Only wanted my bank account number and password. What could possibly go wrong?
Seriously though, these must work for some of the low level fraudsters. It's frightening to think of the personal information that's probably for sale on the dark net, not only email addresses.