You are right, and since this isn't a published Amex number, you'd think that if it were a phisher, that they would spoof a well know Amex number, rather than making up a new one and setting up a fake call center with that number, that answers as Amex when you call.