Most cyber criminals have a script. They don't deviate from the script unless they think they have a potential home run. Even then, going from this to sending out fake mail correspondence... That's a whole different toolbox. 99%+ of the time they will not even consider it. Especially since it's not scalable.
I remember that scammers got in touch with my wife, trying to get personal info. It was fairly elaborate. She got a call from a man that she said had “a golden voice,” followed by official-looking mail correspondence (very quickly, which was suspicious, in itself -it can take many days for my bank to get me correspondence). They had our home phone number, her name (not mine), and address; either through public records, or via a breach (which is why “they didn’t get customer credit card info” is a worthless reassurance).
It was “Synchrony Bank,” telling her she was victim of a fraud. I contacted the real Synchrony Bank, and let them know about the fraud. The contacts stopped.
