When the next prompt was "Please enter your 16-digit credit card number," though, I hung up. If it were actually my bank's fraud department, they'd already have that. I wonder how many people they catch just groggy enough early in the morning who'll blindly enter that info. What do they ask for next, your expiration date? Your PIN?
Be cautious about unexpected calls, and if you think it might be legitimate, hang up and call the number on the back of your card. They can tell you if there's really a fraud flag on your account, you can be sure you're talking to the right people, and they can help.
Do I bother reporting it? To whom? HSBC, even though I don't have an account with them? The incoming number shown is just "1 (201)," which won't get anyone very far, though I suppose AT&T might be able to come up with more if asked by a law enforcement agency.