It starts with a call from someone claiming to be your bank. They know your name. They know your bank. They even know your credit card number. There’s been “unusual activity” on your account, they say—and they just sent you a one-time passcode to verify your identity so they can assist.