The lawful-request desk checks the domain, and the domain was real. Passports, selfies and a year of transactions went out by reply.