A request like this is legally valid (although it sounds like a phishing attempt), however, the financial institution is obligated to verify the requestor before taking action. If they failed in verification, it's a reportable data breach as they gave out your data and deleted your accounts without authorization.

A request like this is legally valid, however, the financial institution is obligated to verify the requestor before taking action. If they failed in verification, it's a reportable data breach.