Additionally, you should contact the bounty manager of that project and let them know about the issue. They should get kicked out of the campaign and other bounties if the manager is legit. I'm sure the bounty manager will be too lazy to see their negative feedback and keep paying them.
I notified some BM's that I'm familiar with. I only checked two campaigns with no KYC that I know of but I'm pretty sure there are more. It'll take a lot of time if I check all campaigns they joined. Now that they've been red tagged, it's up to the bm's to find out why and decide whether they'll still accept those accounts.