Jeez. I pretty much consider everything that comes over the phone or email to be a scam. I haven’t been scammed yet. In the rare cases where it’s from one of my legit accounts, I always log in directly to that institution/service by typing in the URL myself to make sure it’s not a phishing attempt. Rule number one is never ever trust anything coming in over the phone, email, or internet. Someone at any level of actual responsibility in law enforcement ought to know this. The online world is a hive of scum and villainy.
Yup—if I don’t know someone personally I go immediately into scam detection and confirmation mode.
—Hang up on the caller immediately if it is a call.
—If they claim they represent someone actually doing business with me contact that business directly using contacts I previously used to find out if there is something that needs to be discussed.