The Centers for Disease Controland Prevention has issued a very clear and practical document that most practitioners utilize to develop protocols in their practices.
He gives the victim a phony control number to document the fake fraud investigation, and with that, he asks for the three-digit code on the back of the card.