Seems like there's a lot of cross referencing well beyond MFA that this'll likely be used for.

Way easier to target phish people's bank logins, if you know what banks they are regularly communicating with.