A caller's knowledge is not identity proof. Use a five-step protocol to exit the call, reopen a trusted channel, contain losses, and preserve evidence