If someone like a banks calls you, you need to call back from a different phone line, using a number that you look up before giving private information.
Note that most of the time the above doesn't matter, as banks rarely need to call you to get private information. "did you buy X" isn't private - whoever is asking already knows you did: even if they are a scammer you have already lost - if you didn't you need to hang up and call the bank to arrange getting a new account now that your old one is compromised. The only other time that matters is why you know who will call and why (if you just applied for a mortgage you expect the loan officer to call but you also know exactly who that is)