This type of scam is called "vishing", which is short for "voice phishing". There was an article on this the other day. Here is a quote from the article.
Sometimes vishing begins with a phone call, not an e-mail. And these calls are quite believable, because the caller already knows your credit card number. All you are asked to provide is the three-digit security code found on the back of the card. "It is becoming more difficult to distinguish phishing attempts from actual attempts to contact customers," Ron O'Brien, a security analyst with Sophos PLC, told the AP.
If you ever get a phone call from someone that wants personal information such as your bank account or credit card information, ask them what company they are with and for their first name and then HANG UP! After that, look up the phone number for that company on your own. If it is your bank or credit card company then that information should be on one of your statements from them. Call their customer service line. Since YOU are making the call to the number on your account statement then you KNOW that the person on the other end of the phone is really with that company. Tell them that you just got a call about a problem with your account, and they can verify if there REALLY is an issue with your account.