Well I would alert them, something like that could be the end of the exchange. As to giving back, alert as a third party for internal review purposes. They messed up and unless they put some lean on his account which if you only say you know it has happened it should all be good.