Doesn't any legit caller always leave a message? That way, you can think through the security issue before responding.