Simple rule: if it's inbound it is fraud until you've called the official publicly posted phone number of your bank. Don't ask them for a number to call back, go the website of the bank, verify the domain is the right one and call their service desk. Never ever continue an inbound call like this.