If I'm a criminal who is going to take advantage of the hacked data, and I know everybody is rushing to do the 90 day fraud alert, I'll wait for 90 days before

If I'm a criminal who is going to take advantage of the hacked data, and I know everybody is rushing to do the 90 day fraud alert, I'll wait for 90 days before I take action. It is better to think from THEIR angle.