>> Even the old advice not to give out info unless you placed the call is
>> now obsolete because the crooks are sending fake phone numbers via >> email.
> Not at all, you just need to call a known-good number. You don't just
> dial any number you're given, but rather, you need to dial the number
> on the back of your bank card to contact your bank.
That is true. What I wanted to point out is that 'human engineered' phish mail are warning people of exactly THAT and providing (so conveniently) the number of your Chase Bank HQ to phone! (that number is of course manned by scammers ).
Using the number on the back of your bank card is a good way to direct people.
Some mistakes are too fun to make only once.
example?-)