Why do you think it would be a phishing [problem]? Why would a debt collection agency with thousands of accounts risk its license over 1 account? They wouldn't. The lending standards board are starting to roll out a new compliance regulation that all banks and debt collection agencies must abide by. They are handed debt or buy debt from another company/client, that company/client would not pass the debt to an agency that wasnt abiding by the lending standards board otherwise they would face fines of up to £3million and losing their rights to lend. The best way to deal with a debt collection agency is to just answer the phone or call in and go through the security questions and discuss what debt it is that they have been passed. Also with this new lending standards code if you advise them that you are dealing with a debt management company then the debt collection agency cannot by pass the third party. Provided you give details as to your debt management reference number and forward correspondence onto your debt management company. Debt collection agencies are handed a blank canvas debt, they have no information prior to them being handed it so they don't know your situation or if you were even making payments before hand. Just call them up and speak to them, none of this "do everything in writing" BS, debt collection agencies work like call centres, they receive your letter, work through it and action anything that needs to be actioned, then send a "letter received please call" response.

Why don't you actually answer the call, go through the security questions and then ask what the account pertains to? Its possible that one of your accounts in the DMP have passed on the account as you werent making a large enough payment to justify them managing the account anymore and they sold it on. Answer the security questions and see what the debt is about, if its one of the ones in the plan give them your Debt management companies reference number and ask for a statement to be sent out to yourself to forward onto the debt management company. ask for a hold on the account while this is dealt with and go from there. Due to the Data protection act they can't give out any of your personal details even if they believe it is the correct person they are speaking to. They will usually ask 3/4 security questions such as full name, First line of address, post code and date of birth. After answering these questions they can openly discuss everything about the account.