You should always verify with an app or by calling back.
Even the apps you might want to randomize the service worker in case of insider criminal