It's a legitimate Discover Card/Bank phone number.
I got a call from them regarding a legal matter that required me to get a new/updated card, and they just wanted to verify I was actually me. The woman, although very pleasant and knowledgeable of my circumstance, never identified herself, and asked for for confirmation information; said I'd be receiving my new card in a few days.
It wasn't until after I hung up that I thought I may have just been scammed. Regardless, I called Discover today to verify that someone from their organization had indeed contacted me yesterday. Confirmed. I'm happy.
The Patriot Act requires banks and CC companies to collect accurate information on those who have accounts, but it DOES NOT require the customer to provide that information to anyone who calls them, no matter whether the caller is legit or not.
NEVER give your personal information to anyone who calls you. NEVER. There is no way for you to know who the caller is. Caller ID is easily faked. Even if the caller gives you a number to call, don't.
Even if the caller seems to have a certain amount of information about you DO NOT give them ANY personal information. Identity theft / cc scammers are very good at convincing victims that they can be trusted using a tiny amount of personal info they can easily find online.
If someone calls you, just inform them that you will need to call the company back, for security reasons. A scammer -- or a poorly-trained rep -- will try to keep you on the line to get your information. A real pro will say they understand, and ask you to follow up on your own.
DO NOT call any number that an inbound caller gives you. If it's an 800/888/866 number, it's likely that the number is legit, but there are no guarantees; even scammers can get 800 numbers.
Always initiate contact with your bank or cc company yourself, by phone or via the web, using a number or URL you know you can trust -- like the ones on the back of your credit card -- before providing personal information.