They weren’t asking some random third party for information. The payment processor is a clear and direct victim of the fraud. Fraud costs them a lot of money every year.
It is impossible for the victim of a crime to ever not be entitled to turn over every bit of information that they have about the crime. There is no scenario where you have an expectation of privacy from the person you’re actively committing a crime against.