If it was a scam giving your birthday is pretty benign as anyone can find that with relative ease. I think you were right to shut it down. You could google the phone number on the card and see if it pulls up a legit entity. You could also google the name and see if a LinkedIn profile comes up.
I’ve had more sophisticated scammers calling lately. Impersonating police. Had lots of my personal information including addresses and relations. The number appeared legit and even got a call to confirm from another person supposedly over the “officer” that appeared on my caller id as the police phone number. They had been able to spoof it.
Bottom line is the need to be able to call them at a verifiable number.
Thankfully I identified it was a scam and suggested a place for them to go. As part of their scam invoked the FBI I contacted a friend who is an FBI agent and he confirmed there is an increasing number of these scams going on.