I think this is a significant part of why identifying frauds is hard: normal business phone practices are often surprisingly scam-like (e.g. asking to provide verification info when they are the ones calling). So not only do frauds imitate legit activity, legit activity frequently imitates fraud.