That's exactly it. If someone from Netflix (or whoever) calls or emails and says, "You need to update your card info," the correct answer is, "I'll call you guys back and do so." Then you call whatever number you know is the correct number and talk to them about it, updating it, if necessary. Or you could do it on the website that you know for sure is theirs.
The crooks have gotten really slick, setting up web pages that look like the real deal or calling you and sounding like a legit rep from the company.
I used to work for Alarm.com, and there were *******s who would actually manufacture real-looking Alarm.com polo shirts and go from house to house ripping people off. Alarm.com never sends any service people out to people's houses, as the company is a vendor, not a direct service provider. The people who really might send someone out are alarm companies like ADT and Brinks. Companies like that use the Alarm.com platform, but your alarm company is not Alarm.com.
So if someone knocks on your door and says, "I'm from Alarm.com to update your system," slam the door in their face. If they say they're from ADT and you have an account with ADT, still don't trust them. Call ADT first. Normally an alarm dealer won't simply send someone out without making an appointment with you first.
So many ####ing scammers. Keep a database on your computer, or even just a notebook, with all the right phone numbers of the companies you do business with. Never trust someone who calls you up, emails you, or knocks on your door saying they're from one of those companies. Always verify. So many stinking crooks -- it's disgusting.