Last month I booked a flights with Citilink from Melbourne to Bali return for May. Last week i received a whatsapp message from Citilink saying the flights were cancelled until December. The whatsapp profile showed a bluetick mark. Then the next day I received an email saying flights were cancelled and you can email for a refund. So I emailed them for a refund and they sent me a form, the form asks for credit card number and expiry. But when I log into the manage your flight on their portal, it does not show any cancelled status , it just says confirmed.
Question:
How safe is it to provide this credit card info ?
Is this the standard way they process a refund ?