If you're dealing with the bank in a security-consultant capacity, then these kinds of requests would be both intriguing and informative.

If he's a customer of the bank, then it had better be a very small bank or I'm also skeptical.