But he can't add funds to it without logging in to it, which requires him to reset the password. Once the password is reset, the scam can't benefit the scammer.

But he can't add funds to it without logging in to it, which requires him to reset the password. Once the password is reset, the scam can't benefit the scammer. In order for the scam to work, either he has to be able to change the credit card details without knowing or changing the password, or the scammer has to be able to access the account without access to the password or e-mail address. Both of these are serious security issues, but not what the article was about.