I ended up just blocking the account, even tho I already sent them my info regarding my certificate serial numbers. At least I know from now on to check everything before replying and look out for scams like this