This is common for mortages, too. Mine has been sold a handful of times (as are most peoples') and more than once I've had to triple-verify that the dashboard website the new servicer is telling me to go to is legit. They often have extremely dodgy URLs like "mymortgagedash.com" that have no obvious association with the loan servicer whatsoever.

Yes! It’s like half the companies we interact with are actively working to teach people to do all the no-nos that some of us are trying to educate against.