give out or confirm any personal information to a caller who calls me. I tell them I will be happy to call their regular customer service number to address the situation.
Almost every time they are completely OK with this — I imagine that this is not an uncommon response in these days with so many scammers. They never get frustrated or upset, they just thank me for being willing to call in and resolve whatever the situation is.
I think all of the calls I've gotten like these where I stayed on the line more than 20 seconds have been legit. But that doesn't mean I'm going to stop doing it.