> and for security reasons we're unable to offer further details

To give a little behind-the-scenes here, I worked for a bit for a web hosting company that had this as standard policy. This was because, before it was put in place, scammers would actually use coordinated campaigns of support calls with otherwise legitimate accounts in order to extract piecemeal details about how the company's fraud investigations worked, then reorganize their scamming to precisely evade the time periods and credit card checks used at the time.