It seems that Tucows won't do anything unless threatened with legal action.
I'm not sure what the correct instance is to report the ignorance of Tucows as registrar. If it's ICANN or whatever, I'm fine to report to them that Tucows refuses to take action to cut malicious use of the domain name for the fraudster.
If many from here report Tucows registrar for their negligence, then that might put enough pressure on them to reconsider their lame stance.