Sorry for semi-offtopic but my privileges to post a new topic has been revoked (my fault entirely, and its only me to blame.)
Somewhere around 1/20 people usually falls for the bait, generally speaking when it comes to selective phishing with good targets. Here's a another similar, but different method:
Do you have access to a third party email? Want their scans? Check the sites linked with money (paypal, ebay, casino), register documents-paypal.com or doc-paypal.com (really anything to make it look legit), send an email from
security@doc-paypal.com from your mailserver linked to your domain and tell them to verify their account with the documents you want if they want to continue using their service. Just change the email so they cant login to their wallet, or just block their account with multiple unsuccessful retries.
In my experience, 1/20 falls for the bait in selective phishing. If you don't have access to the email, you have to modify your message so it doesnt get stuck in the spam filters of the receiver, it has to look natural and unique. It's usually a gamble when it comes to this, because you can't remove the mail from the spam folder of the victim since you don't have access to their email account, and you never know if its there or not. And it's hard work modifying each email and sending it out manually.
Fully legit scans (cc, passport, bill)=endless possibilities!
If you found this post interesting or it helped you in any way, i'll gladly accept some rep. This method is surely old, but i havn't seen it being described anywhere so i just throw it out because why not.