impendia

A scammer just attempted to phish several attendees at a scientific conference. They falsely claimed to be affiliated with the conference, and asked for their credit card numbers.

The request was made via a document signing service which is apparently legitimate. The email came from the signing service's domain.

I got in touch with their customer service, and they refused to claim any responsibility: "We do not take responsibility for the actions or communications of companies that choose to use our service. If the email you received originated from an external organization, any concerns about its content or legitimacy should be addressed directly with that organization, as the document's sender and owner."

Obviously I am not going to correspond with a scammer for any reason.

Is this legal?? Do I just need to accept that this is the world we live in?