SCAM!!! It would be HTTPS not http! There were many issues and dev posts about this back in beta. Why in he hells would they ask for your token serial number as well?! When you registered it on SE account management site you had to enter it, so they would already have that info.
These scumbag scammers and rmt are relentless.