I don't see how can you prove those "dishonest companies" guilty. And if you can't you won't really have a case.
Those naive people most probable clicked into phishing sites and gave their credentials to malicious third party.
I don't say that the businesses are not necessarily guilty, but why would they risk stealing if they do earn money anyway? Again, you only have a case only if you can prove them guilty.
Well, that's the point, innit? Until someone gets these jokers into a court of law or even into arbitration, there is no way to find out what they're actually doing. We're all just guessing without knowledge. My point is that the mechanism to gain knowledge IS to go to court; you can't magically find that evidence before you go to court unless there's a whistleblower.