How does that saying go? "Never assume malice where simple incompetence will suffice".
Odds are they just screwed up, no need to contact any over reaching regulatory bodies
If this were a legitimate "scam" it would require the $8-$10 an hour lackeys processing payments to in on the scam and not blow the whistle...not likely.