Still, they would need to somehow verify it's the right conference call, and not one set up by a phisher.