Would you mind sharing details ( process wise) of what they did to validate that it was a legitimate request from the account holder?