My DH fell for this scam and gave them all his debit card details, address, phone no and even d.o.b. The web page he had to fill in looked real and the real email address the scam was sent from also look possibly real.
Luckily he had second thoughts and we were able to stop the card before anything was taken.
A week or so later he had phone call, purportedly from his bank, asking if he had made a large payment on his NEW card. They were asking to identify himself by giving them the middle 8 digits or the new card. As he is hard of hearing I took over the call - it is a joint account - so I asked the ‘bank’ to identify themselves by giving me info about myself. The caller said he did not have access to that info.
I hung up and contacted the bank directly on a different phone for safety. It wasn’t the bank that had called. The scammer had failed with his email so was now trying to get the new card no. The real bank agent told us that they would only need the middle 8 digits of a card if they had details of the cancelled debit card.
I think my DH has got away with it this time.
BTW you can check on an email address that appears genuine by either hovering over it, or if that doesn’t work, start a reply and the real email address will appear. Don’t actually send the reply.