ALWAYS CALL BACK. If they are legitimate, advise they should block the transactions until you've been able to reconnect with them. Get their details, and advise you will call back on the company's dedicated fraud prevention hotline.
NEVER give details over the phone on a call you didn't initiate EVER.
Yes, but banks shouldn't be using these insecure processes in the first place. I got a legit fraud text alert from my bank directing me to call a certain number. It should have asked me to call the number on my card.
NEVER give details over the phone on a call you didn't initiate EVER.