But it is suspicious they want to defend vs attacks that don't happen while doing absolutely nothing to stop the attacks that do happen. Seems like security isn't a goal here?
(I didn't get scammed, I sometimes am curious on what the scam is so i lead them on a bit)