Good advice. I suppose my reaction would be to treat it like a suspicious email and call the bank directly with their number posted on their website.

“Thank you, this sounds important.” (a little validation from my call-center days 😉) “I’m going to call you back on a trusted line. Goodbye.”