The person who actually scanned their thumbprint to verify the payments, it now seems clear, was a cybercriminal who ensnared ...