Where is your card issuer (bank) located? I would not drop it at all.

Put together a clear & concise summary (1-2 lines for each item) with each item backed up by a document, which points out that you are due the money and that the email the bank has relied on is a fraud. Simply report the facts. No conclusions.