Can't dispute until posted, and the way the scam works is they get you on the phone as quickly as they can in order to continue to the scam.

Obviously, in hindsight the correct way to handle this is to call the bank yourself. The way the scam works is they spoof your bank's caller ID, and you get a standard "do you recognize this charge? Press YES if you recognize, NO if not".

When you type NO, you get a message stating "our fraud team will be reaching out to you momentarily to resolve this issue", followed immediately by a call from a very convincing "customer support" person, again coming in as a caller ID from your bank.

At this point, I made some "rookie" mistakes as I'd mentioned, but hindsight is 20/20 in these cases where they are trying to keep you on your toes.