@Edent I wouldn't fall for it, since it's asking for a passcode, which the bank would not do to confirm that it's *them* calling *me*.

But I can see that this would be extremely convincing. The bank could definitely word it better. Just a simple "did you call us?" would be an improvement.