Hi.  I've received a letter saying I've been targeted by HMRC for a compliance check.  I suspect this is because when I did the online self assessment it came up with saying I was owed a substantial rebate.  I'm a contractor (using a PAYE umbrella) and my income varies a lot from year to year, so when I earn less in a year than the previous one I usually end up owed lots of tax back as HMRC have estimated my earnings based on the previous year and set my tax code too high.

Anyway this check asks for a recent bank statement and proof of identity which in my case will be passport and birth certificate, and asks me to complete a questionnaire giving details on how I completed the return (ie did I do it myself, use an agent etc). The letter specifically says this is not a check into the self assessment itself under section 9A which I understand is what it would be if they were investigating potential fraud.

My concern is two fold

1. requesting a bank statement, could this be a thin end of a wedge in that if they think anything needs explaining they could then decide to open a further enquiry under section 9A?.  My balance is higher than my current income would suggest because I've earnt a lot more in previous years (as HMRC should know from my previous returns), and I don't spend much.  AFAIK HMRC should not need a bank statement to prove my identity or verify that I am associated with the account as they can request this confirmation themselves directly from the bank.
2. gathering all these documents together is ideal for identity theft if the letter was intercepted.  Any thoughts on the most secure way to send these sorts of documents in the post?  I was thinking recorded delivery but presumably that just tells you it arrived, it doesn't have any actual security benefit, was wondering if there was a particular secure courier service or something someone would recommend?

I'm certain this is genuine and not a phishing scam as the address I've been asked to send stuff to is a genuine HMRC address, and they correctly quote my NI number and Unique Taxpayer Reference number. Nevertheless I do intend to try to call HMRC to confirm.

My current plan is to gather any thoughts from knowledgeable communities like this one, call HMRC to confirm request, and consider if I need to engage a professional - because my tax affairs are relatively simple being PAYE, I've not used an accountant before.

Any thoughts welcome! Thanks

Edit - Uploaded photos of the main letter here https://imgur.com/a/GyS3NEh