You are both right. (If they are legitimate they will have the details and they may want to confirm your identity even though they called you.)
However if you start with mutually zero trust (you certainly can’t be sure that they are who they say they are; they can’t be sure that you are the person they intended to call) … then @SuAkers is right:
I would ask for their name and ring the advertised number back on their legit website.
Given the current level of scam, better safe than sorry.
If you have e.g. a paper bill or other document that contains their legit phone number then that is at least as good as using their web site and in some respects better.
