Sounds incredibly dodgy to me. I’d definitely contact them via your usual route, not that specified in the email.

If it does turn out to be genuine, which would surprise me, I’d be giving them...