Whenever anyone calls you and asks you to confirm your password, you should (initially) give the wrong one. If they accept it, you know they are not who they purport to be. Whether you continue the call or string them along is up to you.
I am getting the same, almost every day. Today she became very aggressive when I refused to share my password. I suspect it is a genuine VM call, but cannot be sure and not prepared to share personal details to a call caller!
What is frustrating, they are not prepared to tell you what they are trying to sell without me giving up personal info... complete waste of my time and if it doesn't stop and job for ofcom.