Xbox Live is dumb and will believe just about anything you tell it.
Phishing is really ewasy to do, but just remember that any company worth anything will contact you
over email or phone, and if they can actually not find your password by themselves, then you should jump ship before things come crashing down from the incompetence.
One fun thing to do is to crinkle paper by a headset microphone and speak in garbled giberish.