Apple won’t phone a user like this, aside from an AppleCare case the user has previously initiated a short while ago. Any phone contact professing being from Apple after repeated password-reset thrust notifications is bogus, and may be disregarded. This fraud normally works in tandem with the faux-receipt scam. https://financefeeds.com/australia-regulator-warns-of-suspicious-digital-gold-vault-investing/