The dialog missed some important text: If this is not YOU calling US, it’s a scam. Hang up immediately. Or words to that effect. I was called by my bank once.

The dialog missed some important text: If this is not YOU calling US, it’s a scam. Hang up immediately. Or words to that effect. I was called by my bank once. They wanted to know if I had spent two thousand euros in a fashion store in Rome. No, I said. They needed no sensitive information for what came next: They cancelled my card and sent me a new one. Later, I logged in at the bank, saw the fraudulent charge, and used their standard protocol for disputing the charge. It was soon reversed. End of story. I see no reason why the bank would have to verify my identity for something like this, or why I would have to verify theirs.