Is it ethical or possible to attack the attacker by spawning a few cloud instances that POST dummy but nearly legit responses to their website? This way they would have to comb through and hopefully verify a lot of crap to find victims' card numbers?

Unless of course they were clever enough to embed some fake cookie to track responses to specific emails...