Security Basics: Bank Exploit

[securityz () delahunty com]

Friend of mine (not me, really) is working with a client of his who claims to have inadvertently discovered a few web 
exploits of several financial institutions.  Does anyone have any insights as to how this guy could bring these to the 
attention of the organizations involved without being seen as a hacker?  His minimal goal is to help the institutions, 
optimally he would like to consult to help them rectify the issues.

thx
Steve