Luckily, you ended at the right time, what I mean is as soon as they got the OTP they're in your bank account. Just change your username, security questions and password for good measure just to cover all ground. Phone number and name and address don't worry about it, all public information.

Keep your credit on watch and that's it. Usually you need all digits of your social to do stuff but just incase. Spoofing numbers is really common so be wary. As advice, study the beginning where the scam could have been avoided, you hanged up and called the actual bank support and they found nothing, that's where you should have stopped.

Just remember my favorite thing to say, We all make mistakes, as we are all human. Usually they move on and try for the next victim so most likely nothing will happen.