We received an e-mail from our card service provider stating that they had been notified by the secret service of an ongoing investigation. They provided us with the card number and asked that we provide the genuine cardholders name, status of the card, and list of any fraudulent transactions. We are confident that the e-mail is legitimate, but shouldn't I get something more than an e-mail? Shouldn't I receive a formal written request or some sort of legal document? Has anyone else received this request? Thanks.

Your service contract with the card service provider may permit correspondence of this type via email. My only concern would be the security of the email messages being passed back and forth.

I have had such a situation, but I cannot see how you can provide such information without a subpoena or customer’s permission, unless it is related to a SAR

Remember that is the case of debit card fraud, when the bank credit's the cardholder and absorbs the loss, the bank becomes the victim. As the victim, the bank can provide information regarding the transactions to aid in the investigation without a subpoena.

Do you know where I could find this information in a regulation? Thank you.