I don't know, I think transferring it was the reasonable thing to do, rather than leaving it in the compromised wallet.
It's like if you find someone's (real) wallet, and you pick it up and contact the owner to ask where to drop it off. Rather than leaving it there and just telling the owner what street corner it's on.
I recently heard about a guy who was arrested and charged for exactly that. He took a phone home that he found in a carpark, the owner texted it saying "please return to Subway" He went there the next day to hand it in and the police were waiting! Apparently he was supposed to have turned it in to any nearby business at the time he found it. Not tried to find out who owned it the next day.
Any nearby business? I thought lost property was to be turned into the police station. Otherwise the owner could call the cops on the business employees "I was never at Dunkin Donuts yesterday."
It's like if you find someone's (real) wallet, and you pick it up and contact the owner to ask where to drop it off. Rather than leaving it there and just telling the owner what street corner it's on.