ehhhhhhhhhhhh I always call back. Isn't that one of the 1st laws of not getting fucked online/over the phone? I go to the company web page (https only of course) and get a phone number. I mean suppose it's possible for an employee to screw you over, but at least it's (call metadata) probably being logged somewhere. Also if I was into security my blog page would be on https, even if that's not entirely necessary for webpages. It throws up a yellow flag to me.