Just called 101 and went though to call operator who checked and then put me through to the person who the email came from. It is legit.No way. This is not required, especially if it’s work related and has all the hallmarks of a scam.
What email address did the email actually come from? Best get someone to check the headers.
If it’s work related I’d report up the chain and to IT. Let the company deal with it.
Whoever makes the statement needs to provide their details so she said it can either be the director or another employee of the company or if I'm happy to, it can be me. Makes sense that it's me because I was the one who liaised with the suspect etc.