My scam-dar registered too when I saw the OP, my boss gets e-mails like that all the time. Her sister should call the bank or company issuing the credit card and ask them if they're investigating any activity on the card. If not, she should report the call to them