The frustrating part is that since so many companies collect PII under the guise of security (and then use it for advertising) it's harder to tell if this is a legal scam or illegal scam.
I has Facebook send a verification through Whatsapp, I legitimately thought it was a scam until I googled it and realized they do actually send verification that way.