The first thing you should do when someone contacts you about a transaction you don’t recognize or with any kind of account concern is hang up / don’t email back and find a valid number for the company from a reputable source and call them back. If they are legit you’ll connect with them, if not you’re already in the right place to get the id theft investigation started.