Nnexxus: Well, I think they just don't need to do any better. Their time is best invested sending this crap to as many people as possible. Eventually, they'll find someone naive enough to fall for this.
Red_Avatar: I managed to scam someone out of giving me his credit card number a few years back. It was some work but it wasn't hard to do. I targeted one person, and it worked right away. Of course now you're wondering why I was scamming this person but it was a dare tied to a bet. The person in question was a friend of a friend.
What I did was this: I tracked him to a forum (he's an avid gamer) which mentioned paying for extras in an MMO (extra character slots or whatever it was, I don't remember). So I pretended to being a new gamer and my credit card not working, and I basically asked him which company he used for his credit card since mine didn't work so he told me which bank had issued it.
After that, I looked up info on fraud control (I forgot the name of the organisation but they're in charge with investigation fraud with credit cards, etc.) - I contacted them through their site to get an official reply through email. This reply I used to create the template for the fake message. Through forum posts I knew his real name and email address and the rest was easy. The email basically said:
"Dear *real name*
We have detected several potential fraudulent charges made on your card. We have blocked them after being given green light by your bank *insert his bank*. Since no theft report was filed and you didn't request for your card to be blocked, you'll be held liable for any fraudulent charges made unless you can prove you're still in possession of your card. To do this, please send us a copy of the front and back of the card accompanied by your most recent credit card bill and copy of your ID card, front and back."
The real mail was a lot more polished and less obvious, of course. I copied bits from a Paypal email which wanted me fax those exact same details to them!!! My credit card front and back, ID card front and back, credit history, last credit card bill, etc.
Well needless to say, he did exactly that - I wrote an article about it for a magazine I was working on at the time but I dropped the story when someone told me that it was actually illegal to do what I did even if I hadn't used the data he sent me (I deleted the email to be sure). But it showed that, if you're smart, you can trick almost anyone. It was maybe an hour or two of work and could have made me thousands of dollars . Well, I did win the bet ;)
First: A very good trick. Amazing, in fact, in various ways. Congratulations! (I mean it, despite what comes next:)
Second: E-mails aren't that safe and if by some accident, someone managed to get hold of the one he has sent you, the authorities would probably get to you first. Ah and deleting an e-mail doesn't really delete it (deleted things can be found even after rewriting them several times). Not from your computer, if it's stored there and not from a server's HDD, though hopefully you and the provider both have taken care of security. Then again, this guy doesn't seem like the "security freak" sort. Maybe his sent email folder ain't that hard to hack...
And of course it's illegal, you used the "identity" of an existing organisation and it's supposed authority (I'm almost completely sure they would use different channels to communicate this, but I'm no expert) to deceive someone into providing his credit card details. Well you meant no harm and I guess this can be called Greyhat something (I don't know what's the official name for this).
Third: Screw that, I think anyone who send anything like this to anyone deserves such a trick played on them. Though you probably didn't tell him (good thing too, he could probably suite you for this, depending on his sense of humour, pride, intelligence, wisdom, constitution, charisma, strength and dexterity. Or maybe only the first two attributes, but only if they are below 13.)
EDIT:
Also, fun facts:
(From the head of their main page)
<head>
<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
<meta name="ProgId" content="FrontPage.Editor.Document"> <title>Website Design/Development, Custom Software Development, and Multimedia Packages Development Company</title>
<meta http-equiv="content-type" content="text/html; charset=windows-1252" />
<meta name="title" content="website design company, website redesign company, web design company, seo, search engine optimization, freelance website designing, Uk, USA, AFRICA, New Zealand " />
<meta name="keywords" content="website design company, website redesign company, web design company, seo, search engine optimization, freelance website designing, Uk, USA, AFRICA, New Zealand "/>
And their page is hosted in the USA (according to flagfox). Doesn't mean much, but won't help convincing anyone...