You could give them a false number and see what happens. That might trip up their script enough to reveal they aren't who they seem to be. Just play dumb -- "I can't understand why it's not working, that's the number on my phone...."

That's also a good idea.

They could trivially spoof the number they're calling from to match.

Or I could call them on a known point of contact, like a phone number or IM.