How to Verify a Caller's Identity Safely
Launch library · evergreen read

When someone calls claiming to represent a bank, a government department or a utility company, the safest response is not to argue with them or answer their probing questions, but instead to simply end the call and verify their identity independently before continuing that particular conversation any further at all.
Look up the organisation's official number from a source you already trust yourself, such as a past bill, a bank statement or the number printed on the back of a card, rather than any number the original caller happened to provide, and never the number left in a missed call log.
When you do call back, mention the specific details of the original call and ask the organisation directly to confirm whether it was genuinely them. Most well run institutions are entirely used to fielding this exact question and will typically answer it directly, without objection or hesitation.
This particular habit costs a few extra minutes of your time but completely removes the caller's control over the conversation, since a fabricated identity simply cannot survive genuine contact with the real organisation it originally claimed to represent in the first place, however convincing it sounded.