And don't use the number from the email.
Phone calls and text messages are the ones I have no control whatsoever, so I try to avoid them at all cost, not just for security but they are irritating most of the times. I stopped voice few years back - https://no.phone.wtf
My kids have just started to get in to Roblox, not bought anything yet but I expect it'll happen soon enough.
Now that you mention it, I noticed that I do this routinely. How do I handle "reset password" situation? I don't remember if the services I have used offer other means of going to the password reset link.
You'll never get 100% of people remembering that advice 100% of the time. So how do you mitigate the situation when they forget?
You get people calling with "your son is in jail and you must buy these gift cards at Target" and it works some of the time.
For your example, the fraudster could say "yes, your account is being targeted by criminals, that's why I'm calling you". The warning inadvertently backs up their story
If their intelligence is that low at that point the criminals can skip all these hoops and directly ask them for their credit card numbers saying they are from the bank and they need to verify them.