Slow down
Urgency is a common tactic because verification becomes harder when someone believes they must act immediately.
Verify independently
Use contact information from an official statement, website or card rather than a number supplied by the unexpected caller or message.
Protect account credentials
Legitimate organizations should not need passwords or one-time security codes simply to 'protect' your account.
Report through official channels
In the U.S., the FTC directs consumers to ReportFraud.ftc.gov; other countries maintain their own reporting systems.
Educational information only. Use current product terms and the rules that apply in your country. For decisions with significant financial consequences, consider an appropriately qualified professional.