As I wrote, they had more than that, they knew my full name, full home address, home and cell phone numbers, full amount of that transaction, what the transaction was for and the date and said they were the company that assisted me with the software I bought then. They had enough information to convince me they were legitimate.
Legitimate? They got that info from credit card receipts and info that are sold to scammers.
Do a credit card transaction and all it takes is an unsavory guy that handles receipts to sell your info.
Had that happen to me (they tried) but I did NOT give the caller any info and blocked the phone number.
Those details suggest that either 1) the original company you purchased from isn’t legit; 2) that company has a crooked employee selling that transaction to scammers or is part of the scammer gang; 3) that company got hacked and all the info you listed was stolen from their server; or 4) the company you purchased from is using a third party firm to process their transactions and THAT transaction firm has problems 1 to 3. So, you see, there are many ways they could obtain those transaction details and them having that info does not make them legit.
Related story: My VERY FIRST e-commerce transaction in the early 90s got hacked. I was at a trade show in Atlanta and, when I returned to my hotel room, there was a message asking me to call my credit card company. My card had been cancelled because the entire database of transactions for Networld/Interop had been stolen and the thieves were making fraudulent charges to the stolen card numbers. Security is obviously much improved since then, but some merchants still keep all transaction info on their servers or the companies they hire to process their transactions keep the info.
All that means is that some company's database of transactions has been compromised and this is how they have found a way to monetize the data they have gotten.