@bethanymarz
Luckily we figured it out in real time together.
But the thing that made us really confused/impressed was how they trigger a legitimate Apple support ticket from a real Apple subdomain (email.apple.com) and then used that ticket # to buy credibility on the call.