The best defense is not to say anything during the call and verify things yourself afterward. If the bank calls alerting you to suspicious activity, the first thing is don't give out your full name, password, security codes, or card number. Period. Scammers are very convincing because they spoof phone numbers well, but that doesn't mean they're real.
What actually works is hanging up and calling the number yourself that's on your credit card or on BBVA's official website (type it into Google directly, without using any number someone gave you). Ask at that moment if there's anything suspicious on your account. That way you know 100% if it was legitimate. If your bank didn't find anything weird, you've got your answer: it was a scam. Watch out for an important detail I haven't seen mentioned: if you suddenly hang up the call, a lot of scammers will call back pretending the line got cut. Don't fall for it. A legitimate bank call will never push that hard.
Also, turn on alerts at your bank if you don't have them (SMS notifications or app alerts for any activity), and think about changing your password if it's been a while. With these two things together you cut down the risk way more.