The best part is that I didn't send the passport to "the guy wanting to give me money". I put it in the form that the supposed HSBC sent me, then the original email address sent it back to me angry and accusing me of trying to scam him out of his money. The whole thing was just a real fun time, honestly.
If you've got the time to spare, I'm pretty sure there are no downsides to fucking with these sorts of spammers, so definitely go and have some fun doing that. It can lead you down some fun roads.