Another measure of legitimacy is to check to see of they’ve even been to your web site. If you have your own domain you can check in cPanel and see the date, time and GPS coordinates of who’s been to your site. Make sure your site is a valid link in your Linkedin profile.
Its not worth your time on the phone with them if they havent seen your work. The overwhelming majority of in house and third party recruiters dont even look at your work which in a vusual field would seem to be a top priority.