My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank.


The bank number is hidden just like many other companies maybe because they use VOIP to make calls or they don't want you to ring them back on the number they call you from.
The person I spoke to refused my proposal to mutual verification of our identities when I asked him to tell me my account number since all the information he revealed to know about me was my name and phone number which are available to the public. 


If you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-up:


Name of the company/service the account is for.
What is the nature of the issue/offer the caller wants to discuss?
Is there a reference ID (e.g.: ticket #) for the call?
Name and/or agent ID of the caller.


Important: Throughout this process, you should not ever give the caller any more of your information. The main point here is to assume that someone calling you like this is an attacker, for the entire duration of the initial call.

Question #1 should be answered by the caller before you even have to ask. Be especially wary if it's not. My wife once argued for a good couple of minutes with someone calling from the "Account Services Department", before she finally handed the phone to me. When I interrupted the caller to ask "Account Services Department for whom?" the caller suddenly hung up.

After you've gotten all you can from the caller, hang up. Then, obtain legitimate contact information for the company from a reliable source (do not use any contact info given by the caller, without verifying it first).

Once you've got known-good contact information, call the company yourself and ask about your account's status. Use information obtained from the caller as needed, to reference the incident.
