Bluffing would be very risky, if turned out the attacker really was a high school kid, or the exploit was trivial. I am inclined to believe them.