Every and any correspondence should be made by mail or e-mail so there is an actual record of the request being made, and a paper trail can be established. If you get a phone call, ask them to send you a letter or an e-mail to the address that they have on file for you so that you can have a copy for your records. If they say they can not, then that is big red flag that it could be a scammer, so you should hang up and contact IRCC yourself to see if the request is authentic. This applies to any kind of official business or transaction, not just IRCC.