If you call them, you can be almost certain that they're genuine. It's really difficult to hijack a phone number without detection, and then to staff it for random calls suggests a level of dedication difficult to find.

So if they call you, never give anything related to security. Always call them back on a publicly verifiable phone number before giving security or very private info.