I think responsible disclosure would be to the people who would most be affected

businesses who have insurance for things like this, and possibly have software to reduce any issues that they would be directly affected by

or users who could lose a significant (and damaging) amount of money if they arn't careful with checking their statements?

It seems silly to support the scammers in this case?