the bottom line is:
never answer any question from a phone call, from an email.

You can contact your credit card company by visiting their web site (double check the domain name of the URL), by mail (double check the address), by phone (the phone numbers must be appearing in their mails to you or in their official website).

Legitimate companies never call or email you for your personal information.