I find that when it’s legit a consistent thing happens, which smells of careful training: they instruct me to call the number on the back of the card, or on a bill.
Only worth it for a targeted attack. Even then I might just read the number off a genuine bill instead of their fake one. And that's assuming they have linked my address and number - lots of scam calls are low effort dial every number.
