I gave my school account to a phishing scammer and it took me 3 hours to notice it’s a scam and change my password… What power does the scammer hold with such info?