[US] Received a call from my “bank” and they knew way too much?

Yesterday, I received a phone call from someone claiming to be from my bank, which is based overseas. In the past, I’ve noticed that many of the bank’s customer service representatives have accents from that part of the world, which the caller also had. That initially made me believe it might genuinely be my bank contacting me. Their phone number was also similar to my banks customer service number, with only the last four digits being different.

The caller said they were from the bank’s fraud department and asked about some recent activity on my checking account. They claimed there were a few blocked purchases from a state I had visited last week (though in a different area than where I’d stayed), and that someone had attempted to add or change names on my account. They asked whether I’d made these transactions, and I told them no and asked what was going on.

The caller then asked if I ever connected to public Wi-Fi (which I don’t) and told me not to worry, assuring me that the suspicious charges had been blocked. They said they could help me reset my online banking username and password for security.

While this conversation was happening, I logged into my online banking on my work computer—which has a VPN and strong security features—and saw no evidence of the activity the caller had described. No blocked charges appeared on my account, which immediately raised red flags.

I told the caller that before proceeding, I wanted proof that they were actually from my bank’s fraud department. He responded that he understood my concern and offered to confirm my account information, Social Security number, or the last charge on my account.

I asked him to tell me my Social Security number. Without hesitation, he read it back to me, which was alarming. I simply responded “Hmm, interesting,” trying not to give away the fact that it was correct.

Next, he said he needed the verification code that would be sent to my phone in order to help me reset my username and password. Right then, I received a text message from my bank stating:

(Bank’s name) will never call you to request this passcode. Your One-Time Passcode is: ######.

At that moment, the alarm bells really went off. I told the caller that while I appreciated his help, I’d be much more comfortable calling my bank directly. He simply said, “Okay, no problem—just make sure you do it sooner rather than later.”

I ended the call and immediately contacted my bank through the official customer service number listed in their app. I explained what had just happened, including the fact that the caller knew my Social Security number. The bank representative confirmed it was definitely a scam and advised me to reset my username and password myself via my online banking. She reassured me that the bank would never call customers to request a one-time passcode or personal credentials. She also said she’d report the incident to the bank’s fraud department.

After hanging up, my mind was spinning. Was it really a scam? How did this caller know private information like my Social Security number? And how did they know I’d recently been in that particular state? (We drove)

While I was on vacation there, I remembered one situation that felt odd. At a beachside restaurant, I ordered drinks and assumed I would pay via the Toast Tab card reader at their window. However, after we got our drinks, the bartender took my debit card and inserted it into a POS system behind the bar instead of letting me scan it on the Toast reader. My friend and I exchanged a weird look at the time, but I didn’t think much of it until now.

Could my card have been skimmed during that transaction, leading the scammers to know which state I’d recently visited? Or was the mention of that state just a coincidence?

At this point, I’m just wondering what I should do to protect my identity and accounts after this incident? Do I need to get a new bank card? I’d really appreciate any input!