This is the best way to go about it if people at the bank aren’t responding. Nobody likes a PR nightmare, and Brian Krebs can handle this better with the right people if the OP provides enough evidence.
https://krebsonsecurity.com/2019/12/ciso-magazine-honors-kre...