An Anecdote
I got a text saying "Your Google account has been compromised, reply back to verify your account"
Well that smelled like a phishing scam, but these thing haven't really happened to me before and I was curious where this was going. I thought I could probably catch what was going to happen before I was phished.
So I replied "K". Then I got a text saying "Please enter the verification code -68- when We will call you."
I couldn't really tell what the angle was yet, but I thought "as long as I don't give away secret information like a password or a 2 factor auth token, I'll be fine"
Then I got a call from a number in DC. It was a automated message telling me to enter my code. It sounded an awful lot like the legitimate automated Google services. I was too curious, I couldn't resist. I entered the code.
A second later I got an email alert from Google telling me my phone number that was linked to Google voice had been claimed by someone else. Then I figured out what happened.
They used a Google voice account to try to claim my number as their own. Google voice tries to verify that you own a number by giving that number a call and having you enter a 2 digit code. So they had me enter the 2 digit code for them...
After that they could have used my number however they liked, and given that banks and other institutions use phone numbers as a way to ID customers they might have been able to do some damage with it if they knew more about me.
I took the number back using the same way they had taken it from me. Hopefully they didn't call anyone in those 2 minutes it took to do that.
I guess the lesson here is that I can't really outsmart a scam as easily as I thought I could.