Unfortunately my UK banks (and others) DO regularly make calls to me unannounced and demand my ID to 'prove who I am'. They are not scam calls and the callers cannot understand what they are doing wrong. If I'd had more strength in the last round of this stupidity I'd have done a number on them with the regulator. (I used to work in finance and was the director of a regulated financial entity, so I think I'd have a head start.)

That is an unnecessary interrogation, you don't need to verify the initial call at all. Simply call your bank on your own.

I ask them for all of that and their credit card details, mothers maiden name, name of their first pet, first school they went to, and what colour underwear they’re wearing.

I should probably learn how to insult their mother in Hindi too.

This. If people have a "real" reason to correspond with you they will have no problem making a record of it via a voicemail or text or email or whatever.

That does seem better than blind trust but that app infrastructure could get compromised. I would still be wary in any situation where I did not originate the call with the bank.

Truecaller can tell you about who a phone number belongs to.

Truecaller cannot accurately tell you whether or not the person calling you from a phone number is actually in control of that phone number.