You're right thisisgood. With your area of work they will ring and ask information about a client. However, if you don't know the worker by name and haven't had anything to do with them before, you can request that you call them on the direct office number and ask for that CSO so you can verify that they are who they say they are. This protects yourself from giving any information at all (no matter how small it may be).

Getting the CSO to put their concerns in writing is a good idea as well, and really, it's the way it's supposed to be. The phone call should be just to let you know who they are and that they are after information about a mutual client and that they will be emailing/faxing a request to you.