I think responsible disclosure would be to the people who would most be affected businesses who have insurance for things like this, and possibly have software

I think responsible disclosure would be to the people who would most be affected businesses who have insurance for things like this, and possibly have software to reduce any issues that they would be directly affected by or users who could lose a significant (and damaging) amount of money if they arn't careful with checking their statements? It seems silly to support the scammers in this case?