I’m on the “be polite but firm” side of the fence, unless it’s obviously a scammer, in which case you should keep them on the phone as long as possible.
As someone else has said, it’s human beings doing a crappy mind-numbing job.
I did have a call from Amex the other week that went something like….. “I’m calling from American Express (which they were), can you confirm your identity?”, me “No, you called me, so you should know who I am, and I don’t give that kind of information out over the phone to people who call me – it’s a security risk, don’t you agree?”, Amex “Ah, OK, bye”.