I've gotten legitimate calls and texts from my bank about fraud (Citi and Capital One in the last year or so), and it's usually a quick 5-min discussion (yes that was me, no that wasn't me, etc). They usually ask for confirmation of identity at the start of the call, so that wasn't out of the ordinary.

What I usually do is go to my computer and login to my bank to check transaction history, so I can verify what they're saying. However, I was out of town and wouldn't be back in town for a couple weeks, and it was a new phone so I hadn't set up the app yet. Even so, there were some red flags I should have noticed, but didn't (probably due to being somewhat exhausted from traveling the entire previous day):

• text number wasn't from my bank's normal notification number - should've been a huge red flag, but just looked at the content (was dealing with the kids at the time or something)
• phone call came from Tennessee, not the normal bank number - fraud departments often have weird phone numbers, so this wouldn't have helped much, but I should have searched the number (the fraud dept numbers are usually listed on their website somewhere)
• they asked for my authentication code before telling me some identifying information about the account (usually they specify the last 4 digits of the card or something); didn't notice since I had run through fraud alerts a few times recently on different accounts

Also, I usually just ignore numbers I don't recognize, which would have prevented the whole thing as well, but this was a new phone and I hadn't yet transferred everything, so I didn't want to miss something important.

I usually practice pretty good security, but I didn't notice until halfway through the call. However, at least I did notice and was able to prevent any actual harm.