Credit card companies have already solved this problem by publishing a well-known 1-800 number that their customers can call back to verify the intent of an unexpected caller.

Google Duplex can do the same thing - without even staffing a call center.