The only ethical course of action is to stop the circus and explain to your manager:

- what this guy is asking for

- how that is in violation of the PCI data security standard

- explain that you are not able, and not allowed to provide this information

- explain that this likely means the auditor is a hack and steps need to be taken to get a proper auditor