Avoid giving out passwords, verification codes, or internal procedures over the phone. Attackers often use urgency or authority to pressure victims into sharing sensitive information.