Deceptive web content, pervasive across the internet and commonly known as social-engineering attacks, manipulates autonomous web agents into submitting users’ personally identifiable information (PII) to attacker-controlled endpoints. In this paper, we show that these attacks are highly effective at extracting the most sensitive data an agent holds for its user (SSN, card number and CVV, bank account, passwords, API keys; the critical tier), posing a severe risk to deployed agentic systems. To quantify this risk, we introduce Scammer4U, a pre-registered benchmark of 91 attacker-controlled websites spanning 8 attack vectors and 16 site categories on an eight-axis taxonomy, together with 10 benign twins of those sites with the attack removed and the legitimate task intact. 60 of the 91 differ from a sibling site on exactly one axis, so any leakage difference within a pair is attributable to that single design choice. Under no privacy guidance, critical-tier leakage reaches 54–93% across four frontier agents, against 0% on the benign twins, so the leakage is caused by the attack and not by ordinary form-filling. Escalating prompt-level mitigation yields sharply model-dependent reductions across the four families and, pooled across them, remains insufficient to reliably prevent critical PII submission. Most critically, we identify a detection–action gap: agents whose reasoning an independent LLM judge confirms has flagged the site as suspicious still submit critical PII in 35.9% of sessions, versus 66.1% when no suspicion is verbalized, a gap of 30.2 percentage points that holds across all four model families. Defenses that gate on the agent’s own recognition of an attack are therefore gating on the wrong signal. This motivates intercepting outbound submissions at the point they leave the browser, independently of the agent’s reasoning loop.