Yes. Chain of events as follows:
Received email alert from bank that a profile change had been requested. Call the number on the card at once if I did not make the request.
Called the number and sure enough everything had been changed, including password. Confirmed by trying to log on unsuccessfully. After confirming my ID, card was cancelled, new card on the way to my real address.
Asked them if they would tell me the address the thief had used in the new fake profile but they said they couldn't divulge that info. :-) Oh well, I tried.
Yes, pretty good evidence of legitimacy. Now if they told you to call an number that started 011-234 or 011-7, it would be a different story....