Banks do not do this. It sounds like a phishing attempt because it is.

Imagine the cost of calling every single client individually. If something like this would change, they would send a letter.

Don't forget that spoofing caller ID of telephone numbers is possible.