Not 100% sure on this, but emailing sensitive customer info doesn't sound PCI compliant. Maybe customers should look into suing this bank.