"Your bank will never ask for your PIN or full password" is genuinely good advice, and it's still true. But scammers have adjusted their scripts to work around it, which means the advice alone isn't quite enough anymore.
What's changed
Rather than asking for your PIN outright, a scam call might ask you to "confirm" a few digits, or talk you through moving money "to a safe account" while sounding exactly like a bank fraud team. No PIN is ever spoken, but the outcome is the same.
A convincing script doesn't need your PIN if it can talk you into doing the transfer yourself.
The safer habit
Any call about suspicious activity on your account, however calm and official it sounds, is worth ending and calling back using the number on the back of your card. A genuine bank will never be offended by this, a scammer will often try to stop you doing it.
Watch for urgency dressed as helpfulness
Scam calls in this style often sound helpful and reassuring rather than threatening, which is precisely what makes them effective. Calm still means verify.
Verified numbers, ready when you need them
Save your bank's real fraud line before you need it. See the shortlist on the Free Resources page.