You're overestimating the legitimate companies' employees security acumen. They do it all the time. Sometimes when a legitimate company asks me to verify somet

You're overestimating the legitimate companies' employees security acumen. They do it all the time. Sometimes when a legitimate company asks me to verify something, they do it by telling to me. As in, "I need to verify your date if birth. Is it xx/yy/zzzz"?