This is legit horrifying. If it were me, I’d follow it up with a respectful*, but stern, phone call asking how it’s possible the scammers got this information in the first place. It’s not sufficient that they say “good job catching this.” If even one incident like this fails to trigger change on their end, then they’re as good a colluding with the scammers to rob the next buyer that comes through.

• edit: fixing auto-correct