But most people do none of these things. They'll click links in emails, respond to texts, and so forth. I suspect that they do this either out of ignorance or laziness.
The problem is, as Doctorow discovered, we are all, without exception, vulnerable to phishing attempts and other con games. Not all the time, but if one catches you at just the right moment...
It's alway wisest to never trust inbound - expected or not.
I wanted to just forget about it, but after questioning my wife about it and thinking about for a long time and going through our bank records, we found that one time when she went to the doctor and didn't have her insurance info or something, so we never knew we had something to pay and instead of contacting us directly, the unpaid bill went straight to a third party recovery service. It was a small fee, so I assume they lost most of it by paying the recovery service. We didn't move or change email/phone number or anything, so the doctor's office must have failed to save our contact info.
The recovery service probably found our number just with names and basic info I guess.
And yeah, it makes sense that they can't tell us what it the bill about or which doctor's office it is.
People still answer phone calls like this? I've never trusted incoming calls if not a personal contact. If it's your bank you can call them back.
That person calling you, knocking on your front door, sending you an email or DM? At best it's someone trying to sell you something but likely someone trying to scam you.
There is no upside and lots of potential downside for trusting an inbound request of any kind.