Ran across this article today on BankInfoSecurity.com and reminded me that we have seen this simple scam recently too. At banks where we have seen this it looks like the phishers are just finding phone numbers in the phone book or local directories, picking a financial institution and calling all the people in the phone book, even if they aren't the bank's customers. The call is automated and sounds something like this...

"Hello, we are calling on behalf of (Insert FI Name Here) and want to confirm some recent purchases posted to your account. Will you please type in your PIN and Debit Card number with the 10 Digit keypad....."

This doesn't work for many accounts, but all they need to do is have two successful hits and it pays for itself. The calls come from a hosted data center, and can be shut down fairly easily by the FBI, but are rarely tracked back to the fraudsters. The calls are usually shut down within a few hours at no cost to the financial institution, unless some customers fell for it.