got 2 messages on the answering machine from "hsbc" fraud prevention asking me to call them back at this number. i thought it was bogus so i called the number on the back of my atm card and reported it. the next day, i had an email with my full name spelled out asking me to call the same number, so i again called the number on the back of my atm card. i eventually spoke to someone in the fraud prevention department that confirmed there was a hold on my internet banking account due to suspicious activity (i logged in from my work and home computers in the same day, which must have thrown a flag).
tldr; there's a good chance this is legit, but take care of it by calling the number on the back of your atm card to be sure.