I don't even know where the idea that those are the best practices came from. The phone number best practice has always been constructed as "call them back at

I don't even know where the idea that those are the best practices came from. The phone number best practice has always been constructed as "call them back at a known good number, preferably one written on paper or on your card". You certainly don't ask them to show you where on the company website the phone number is listed. And asking the person on the phone with you to send you an email from a specific domain is likewise not something I've ever seen recommended: that's one of several things you check to see if an email is phishing (And only one of several! A good domain isn't enough to clear an email!) But if you're already on the phone with someone suspicious, the best practice has always been to get off the phone with them immediately and call a known number, not to ask the caller to prove themselves. None of this is to blame OP for misunderstanding, it's just very clear that we need to do better at communicating these rules out to the world.