Cybercriminals buy personal data from brokers to personalize tax scams with fake IRS messages, making fraudulent emails feel legitimate for identity theft.