^ THIS. your bank is training you to get phished. your health insurance, by leaving fake-urgent voicemails that require miserable phone tree navigation when you call back, and by having a million different numbers which resolve to 'scam or at least spam' aggregator sites when you google them, is teaching you to get phished.
my health insurance has a process which involves calling me and asking for a bunch of personal information. I called them back at a known number to ask if this was their number and they didn't know. I called three agents and they gave me three different answers. One said it was a 'system error that will be resolved in 24 hours'. Another said it was fake, don't trust it. A third called the number while I was on hold and assessed it as 'probably fine'.
teach someone to get phished and they're phished for the rest of their life
never accept inbound calls