By now you've figured out that when a stranger calls with a request for sensitive information or something that could be of value to an attacker, the person receiving the call must be trained to get the caller's phone number, and call back to verify that the person is really who he claims to be—a company employee, or an employee of a business partner, or a technical support representative from one of your vendors, for example.