First, how do you know it's EY and not HSBC which is mistaken? Why have you made up your mind as to who is at fault? "Security purposes" could mean much more than simply what your bank thinks it means.

Second, why not get EY and HSBC on a three-way / Conference call and sort this out so that neither can make a blanket statement.