The first thing that comes to mind here is to be very careful--especially with how privacy is these days. The second thing is how did the son know to contact your bank for information if he has no idea where his father had accounts? Is he then sending letters to every financial institution in the area in hopes of hitting the right one?
I think, aside from verifying the father is actually deceased (if you don't already know), you may want to make sure the son is who he says. Past that, legal council may have to get involved.
I am certainly no expert here
, but that's my instinctive reaction.