The best thing to do to these people (assuming you are bored/have the time to mess with them) is to let them connect to a Virtualbox VM and WASTE THEIR TIME, and then not tell them that you are wasting their time, and most importantly, NOT TELL THEM THE MISTAKES THEY MADE. One time I saw a video of someone from Malwarebytes doing just this. They connected the person to a Virtualbox VM and wasted a bunch of their time, but at the end of the video they explained to the person what they did wrong and practically gave them instructions on things they could've done to make the scam more convincing. I facepalmed at that. You do not give them instructions, or tell them what they're doing wrong. You just waste as much of their time as you possibly can.