[mLuby]

Let's say you call or text me, requesting gift cards or my password or something else weird.

I tell you I'll email you immediately to verify. I email you to confirm you want N $X gift cards. You do so.

Or if the inbound contact is by email, you verify by text or phone call. Or Signal/Discord/FB chat apps, etc. Heck even LinkedIn Inmail could be your verification channel.

You could still be compromised, but that'd require attackers to have significantly more access and readiness. And if you reach the other person and they're unaware, now you both have some support as you figure it out.

[jamesshamenski]

If one service was compromised, isn't it reasonable to think that the scammer can access other services during this breach?