Assume anyone asking for your account information for any reason is guilty of scamming you, unless proven innocent. The way to prove innocence is to call them back, or login to your account using numbers or a website that you provide, not them. Don’t release any identifying information while they are contacting you via phone, message or email. You must control the channel.
The best ideas often come from the front-line employees who face challenges every day.
Truth is so hard to tell, it sometimes needs fiction to make it plausible.