At the very least, the employee should record the caller's name, phone number, and office or department, and then hang up. Before calling back, he should verify that the organization really does have an employee of that name, and that the callback phone number matches the phone number in the on-line or hard-copy company directory. Most of the time, this simple tactic will be all that's needed to verify that the caller is who he says he is.