Never provide personal or especially financial information to any communication (phone call, text or email) that you did not originate. The increasing sophistication of scammers requires making this a hard rule.
I have seen some clever scams recently -- a call from my "bank" that actually showed up as my bank's number, that then had me call them back on a number that showed up as belonging to the bank on Google, and they recited to me some correct information about myself. It failed when they could not provide a piece of information that they should have had available if they really had access to my account data as they claimed.
What they did to set it up was to spoof the actual bank phone number, and had seeded the web with pages listing the fake number as a bank number so that Google would show it as belonging to the bank. And they had gotten publicly available information about me from one of the privacy invasion companies that sell your data and they had a sophisticated script and a guy who was a pretty good scam-actor for the person I called. I can readily see most people being taken in by a scam set up like that. They key to revealing the scam -- you must tell them to provide a secret piece of information that you select that the real party would have but someone who did not have actual access to the internal systems could not.