This is a pretty interesting scam, where the scammers did their homework and anticipated some of the actions the victim would take and even turned those to their advantage. The lesson is that when your bank calls you to report suspicious activity, ALWAYS HANG UP AND CALL THEM BACK USING A NUMBER FROM THEIR WEBSITE OR ON THE BACK OF YOUR BANKING CARD.