It is the right action, and they should say exactly that when they call: we need to talk to you so call us at the number in our website.

Instead they try to do the wrong unsafe thing, but when pointed out they switch the script. So they can't even claim ignorance of basic security .