Five steps, in order.

Do nothing for sixty seconds. Every scam of this kind depends on you acting before you think, which is why pressure to hurry is itself a warning sign. A real emergency survives a one minute pause. A fake one usually does not.

Look for the pattern rather than one detail. An unfamiliar number explained away before you ask. A deadline. A reason to keep it secret. A payment method you have never used with this person. Any one of these can be innocent. Together they are a reason to stop.

Hang up and call back on the number already saved in your phone, never the one you were just given. For a bank or a company, type the address in yourself instead of following a link. This single habit defeats most of these attempts on its own, because whoever contacted you cannot answer that line.

No money, no passwords, no verification codes, no gift cards, no remote access to your computer, until you have confirmed independently. Nothing legitimate is lost by waiting an hour. A great deal can be lost by not waiting.

Contact your bank first if any money moved, then report it to the fraud authority in your country. Tell the people around you what you saw. These attempts run through whole address books, so the warning matters far more than the embarrassment.