@nprofile1q... It's a shambles of incompetence and infosec cluelessness.
A year or two ago I got an unsolicited call from a mobile phone number from someone purporting to be an employee at my bank.
I told them everything about their approach smelled of a scam. To reassure me, they MMSed me a fuzzy snap of their business card. I looked them up on LinkedIn to find an incomplete profile of an employee at the bank. So what? That's not proof of anything.
I'm pretty sure the whole thing was for real, but I'm also 60% sure it was a scam. The caller (and I believe a colleague of theirs) arranged an appointment at a bank branch in my city. Stringing them along, I agreed. Days later I got a follow up call confirming the appointment. "Yes," I said in a voice dripping with contempt, "Sure I'll be there."
I got an irate call a few minutes past the appointment time, asking me if I planned to show up. I had to explain again that every single thing about their approach smelled of a scam and - assuming for a moment they really were who they said they were - what on earth were they doing training the clients of the bank to ignore all red flags that banks attempt to educate us about?
I never did write to the bank. I ought to. The whole thing stank.