What worked well for me was to tell the caller that I wanted to call them back for security reasons, and write down the number.

Searching for that phone number will (if it's legit) likely point to a contact page on the bank's website.