hrm this isn't even registration swapping, it just seems to be phishing or grifting.