I agree, they could of give us a number to contact and then give us some of our details what they should have as proof it's genuine and took our details over phone, but if they say do it by email it could be so they have evidence in black and white that they are doing something about the security error they made