More Holes Than a Colander
HMRC, DWP, The Home Office, NCA etc. ?
Take your pick.
They can all ask banks for your data.
However, my money is on them claiming they were from HMRC:
Under standard domestic laws and international treaties like the Common Reporting Standard (CRS), UK banks and building societies extract key pieces of your KYC file and send them to HMRC automatically. A broader data set wouldn’t therefore appear unusual.