Another top tip is how to response to “can I just confirm”. No, they can't just confirm any details, until they have confirmed who they are, which they can't do without us calling them on the company's published support number.

Luckily my parents are appropriately cynical and have not fallen for anything like that, but I know a couple of people of my generation who have (in the worst case losing 5K+ in savings, back when there was no onus on UK banks to take any responsibility for such fraud through their systems so it was properly lost to them).