If they were in the U.S. I'd be suggesting they lawyer up.
They're not broadcasting to the world that they think you're a con, they're just telling you... Which is fine.
Its privacy requirements are limited to giving you a copy of your personal information. Name. Address. Phone number.
Anything else (including the marker labelling you as a pillaging hobo) is their proprietary business intelligence and good luck convincing them otherwise.
I have used Wikipedia for the definition of how one proves libel:
There are several ways a person must go about proving that libel has taken place. For example, in the United States, first, the person must prove that the statement was false. Second, the person must prove that the statement caused harm. Third, the person must prove that the statement was made without adequate research into the truthfulness of the statement. These steps are for an ordinary citizen.
Of course, there is no citation. I just added the {{fact}} tag. But does anyone know if this is true or not?
What is to stop somebody extensively researching something but then just deciding to lie anyway?
If I tell you I think you're lazy, that's rude but it isn't defamy. If I write you a letter and you publish it, it's still not defamy.
If I talk to your boss and tell him I think you're lazy (without evidence) that may be defamy. If I publish a letter to you telling you you're lazy, that may be defamy.
And no, this has nothing to do with the rest of the issue.
Only if they published it to the world, she could claim her reputation has been harmed.