Official agencies do not contact one through email for official business where it is necessary to give them access. This is scary and unfortunate. A good vigiliant practice would be to call the official customer service number listed for that vendor and verify if they sent anything.