I would just count this as a learning experience and move on. Who I would be interested in going after is not the scammer, but instead AT&T. The fact that the

I would just count this as a learning experience and move on. Who I would be interested in going after is not the scammer, but instead AT&T. The fact that the scammer knew you had just received a card, already knew your personal information (at least knew enough to convince you they were from AT&T) is very suspicious. These kind of scams operate using the inside connections. Inform AT&Ts security department, and if they dismiss you and don't replace the card, then inform the media. AT&T should be motivated enough to setup a sting and put people in jail over this, but if they're not the media can embarrass them in to it.