I got a letter from Citibank demanding I prove my business was legit. I sent them a "secure message"(on their online site) containing the documents. But(accordi

I got a letter from Citibank demanding I prove my business was legit. I sent them a "secure message"(on their online site) containing the documents. But(according to them) they could not open those secure documents. They called me and asked for the password for that secure message. That was of course a red flag so I went to the local branch and asked them to send those documents to whoever it was that was requesting them. Going to the local branch stopped them from sending any more demands for documents so it seems it really was Citibank who had sent those demands to me. But for them to ask for my password in a phone conversation is a huge Red Flag right? And they never sent me a confirmation that issue was resolved. I should have reported them for asking for my password, but did not know where should I submit such a report. Big banks are too big.