> How does phishing like this scale? I think this is the wrong question. You only need "scale" when your response rate or "take per device" is relatively low.

> How does phishing like this scale? I think this is the wrong question. You only need "scale" when your response rate or "take per device" is relatively low. In this case, I suspect the success rate is incredibly high and/or if it lets you unlock and disassociate the the device from the account, the device itself becomes more valuable. It's a win-win for the bad guys.