The scammers you cite are generally using stolen points, or more precisely, points from compromised accounts. Generally, with regard to flights, points can only

The scammers you cite are generally using stolen points, or more precisely, points from compromised accounts. Generally, with regard to flights, points can only be accrued in the name of the person travelling and can't easily be transferred or aggregated between accounts, so changing the FF# on an active reservation doesn't really help you. You couldn't accrue all your stolen points to one account - you'd end up with a few points in hundreds of different accounts which doesn't have any value. On the other hand, phishing credentials for accounts with hundreds of thousands of points already in them could be quite lucrative.