Assume anyone asking for your account information for any reason is guilty of scamming you unless proven innocent. The way to prove innocence is to call them back using a number you know is correct, or login to your account using numbers or a website that you provide, not them. Don’t release any identifying information while they are contacting you via phone, message or email. You must control the channel. Never click on links in websites or emails until you verify they are legitimate. If asked to sign in on a website open your own link to that website and sign in through that.