ALWAYS CALL BACK. If they are legitimate, advise they should block the transactions until you've been able to reconnect with them. Get their details, and advise you will call back on the company's dedicated fraud prevention hotline.

NEVER give details over the phone on a call you didn't initiate EVER.