I'm speculating, but rather than use the credentials to transfer money (which is unquestionably criminal), it's more likely they would log into such accounts to

I'm speculating, but rather than use the credentials to transfer money (which is unquestionably criminal), it's more likely they would log into such accounts to find your name and address (which is also criminal, but w/e) so they can follow up with demand letters.