Probably can check out does this constitute to internet cyber crime. From the reading it looks like more of harvesting of credential (but voluntary maybe it is unknowingly). Privacy rule will have to come in but probably better to seek advice from the law enforcement authority (or complaint centre) if the case is not clear
Ref to US'IC3 (for info)
> Internet crime is defined as any illegal activity involving one or more components of the Internet, such as websites, chat rooms, and/or email. Internet crime involves the use of the Internet to communicate false or fraudulent representations to consumers. These crimes may include, but are not limited to, advance-fee schemes, non-delivery of goods or services, computer hacking, or employment/business opportunity schemes.