I've gotten both calls and texts from my bank and credit card companies about fraudulent transactions. Indeed, I want them to do that, so I'm alerted as soon as they spot something fishy.

But if I get such a call or text, I don't answer it. Instead I do what you describe--call the official number that I already know independently. (Or I log in to their website to check for alerts.)