You absolutely did the right thing not giving out any information at all. Just someone phishing via phone, hoping you'll panic and share useful info and then they can magically confirm what they were calling about with the info they just recieved, from you!!