For the record, Apple will never call you first, but other services might. The REAL first rule of not being scammed should be stated

"Thanks for the concern, I will call you right back"

If your bank calls you, you turn off the call and call them. Don't take suggestions for contact address. You look them up, and you call them. Don't elaborate. The scammer is either and idiot and will try to call you telling to stop, or smart and fuck off. And if it was the bank, they'll at best, pick right back from where you left it, and at worst, learn better from the event.