Two things this reminds me of:

1) When my bank detects unusual activity, I get a voicemail asking me to call a special 800 number for the fraud department to review the details. I always make a point to call the general 800# on the back of my debit card and get tranferred to the fraud/security group for this very reason. How easy would it be to call people and leave a message to call a strange phone number and give not only their credit card details by identifying info "for your security?"

2) My partner works in an entertainment company's travel department. Regularly, paparazzi try to call pretending to be some celebrity's assistant to "confirm" hotel/travel arrangements. They don't get away with it.

Both reminders to always be vigilant about unverified people contacting you and requesting confidential information. Anyone who legitimately needs the info will understand your simple request to recontact them through some trusted channel and you'll be much safer for the precaution.