The person who contacted you was most certainly not a "white-hat hacker". This is not how they operate. The person is most likely trying to scam you in the simplest possible way.
What is a White-Hat Hacker?
In the simplest terms, a White-Hat Hacker (henceforth called "White-Hat") is a security professional hired by a company, group or individual (henceforth called "customer") to test a system owned by said customer.
The White-Hat and the customer agree on a scope of the test, the timeframe, how vulnerabilities should be reported, user accounts for systems to be tested and similar agreements. This is usually referred to as a "Permission to Attack" and is the legal basis of the work of a White-Hat.
Then the White-Hat proceeds to do their work, writes a report and makes suggestions to the customer on how to improve the security of their system.
Simplified, a White-Hat is a Hacker you hire to test your systems.
What is a Black-Hat Hacker?
A Black-Hat Hacker (henceforth called "Black-Hat") does not have an aforementioned "Permission to Attack" and tries to find vulnerabilities wherever they can. Since their "work" is not backed by any legal grounds, they don't need to worry about playing by the rules, collateral damage, etc.
Black-Hats can have various motivations. The overwhelming majority does it for monetary gain, although others can be in it "for teh lulz", for political reasons or for their own personal convictions.
Simplified, a Black-Hat Hacker is a Hacker that tries to exploit vulnerabilities without any legal basis to do so.
I've been contacted by a person claiming to be a White-Hat regarding a vulnerability. Is it a scam?
Not necessarily. Some products or programs reside "offline" and are thus owned by the White-Hat Hacker. I don't need permission of a lock manufacturer to pick a bike lock that I bought from them. (I do however need permission of the owned of that individual lock!) If I found a design flaw in said lock, I can contact the manufacturer and inform them of said vulnerability.
Similarly, I could buy a product and analyze it. If I found a vulnerability, then contacting the vendor through a responsible disclosure procedure would be the only ethical thing to do.
However, in such cases it always has to be asked "Who's system was attacked?". In case of the bike lock, it is clear. I owned the lock, hence I can attack it. With software, especially cloud-based applications, the issue of ownership becomes much more complicated.
I stick to the rule "When in doubt, call an expert!" and in this case an expert would be a lawyer.
To summarize the question, "It's not always a scam and could be an attempt at responsible disclosure. Proceed carefully."