I think the lesson from this is that if anyone rings you from the bank or the credit card company, you say "Who's this? I'll ring you back - what's your number?", then ring back the bank itself, rather than the number they've given you, and check it out.