A telephone notification can also be malicious, but it may be easier to ascertain whether it???s genuine: at any rate, it can???t be purely random, and there are ways of verifying such as calling back a known valid number (for instance, the number found on an account statement).