> you're assuming that "bank security" (or the like) will never call you to alert you to a scam, or that you will recognize their number

I'm assuming no such thing. I have indeed gotten calls and texts from my bank and my credit card companies alerting me to fraudulent transactions, that were legit calls and not scams.

But I didn't answer those calls or texts directly, or try to figure out whether the number that was calling me or texting me was the right one. What I did was to call a number that I already know, independently, leads to my bank, or to my credit card company's fraud department. Or I independently logged into the bank's or credit card company's website to see if there were any alerts. And if there were, I acted on them.

I described this in my earlier post: "If they claim to be from some company I have a relationship with, I check independently to see if something's up."