BUFFALO, N.Y. (WIVB)–Joe Kennedy has been shining up cars for nearly 50 years at his Elmwood Avenue shop, Joe Kennedy’s Auto Beauty Center, but he was stunned by a bizarre email, saying his Visa card had been frozen due to some “unusual activity” on his account.

“Out of the blue I got an email–I was home one night–and it said, ‘alert Petal card.’”

Kennedy recently got the Petal Visa card, issued by Petal Card, Inc. of New York City, and the email instructed him to do one of the following to unfreeze his account:  Send the bank a “selfie” of himself, holding a picture identification–like his driver’s license or passport–next to his face, and link his primary bank account to the Petal card.

Or email the selfie with his driver’s license, and three recent bank statements, and a recent W-2, or Form 1040 tax return, or recent pay stub.

Joe was aghast, thinking it was a scam. He called the customer service number on his Petal card and the bank confirmed he would have to sacrifice so much of his privacy to reactivate his account.

“I said there’s no way in the world I am going to send you a selfie of myself holding three bank statements, either using a license or a passport, and then you have all my information. I said I would not do that to anybody.”

Scott Laughlin, Executive Vice President for the Consumer Credit Counseling Service of Buffalo said clicking on a link to an email, as Petal demanded of Kennedy, is practically inviting identity theft.

“Click a link in the email to verify his identity–that is one of the number one things we tell people not to do because it is the quickest way to lose your identity.”

Laughlin said he doesn’t believe giving up that much privacy for a credit card is worth it, “I personally would not respond to this type of thing, and if they closed my account I would say, I did not need you anyway.”

News 4 called Petal Card, which seems to be linked to the firm WebBank, and a representative confirmed the identity confirmation policy that seems counterproductive to customers’ privacy.

It is a policy that seems pointless, since the bank is barred from trying to confirm a customer’s driver’s license with the Department of Motor Vehicles, or a passport with the United States Department of State, or tax returns with the Internal Revenue Service.