Some people can be very naive or over trusting when it comes to sharing information publicly or to answering requests from banks or people purporting to be from banks.Something doesn't ring true for some canny enough to have a business and 40k cash, would be as naive as claimed.
Though to err is human.
People should never take a cold call and give out information. Ring the organization back on their independent direct lines.
It is probably good to have a measure of distrust when dealing with a bank. Banks often request info from people that they neither need nor shouldn't be given.