So I am guessing he used the number in the email to call the bank? When I have stuff like that happen to me, I visit the official web page of the company and I call the number right from that page. I don't trust any numbers that are given to me via email.