I agree with the above couple of comments I just hope it's genuine and we all get our refunds. I asked them what sites I had used but they didn't answer just said my refund is on its way
Let's hope it's genuine I spoke to customer service and they said it's due to a change in law in the U.K. And the email address is the only one I should respond to but they said legally they can only communicate by email (the security team) still haven't sent my details if genuine mine will be £730