This is a scam right? Voya financial calling saying I have no beneficiary, while husband is clearly on account through web portal?

They knew my name, my employer and my 403b distributor. I let it go to voicemail and they left a message saying they were calling from Voya, were concerned about the financial health of my account and especially my lack of beneficiary listed.

Logged into my Voya account and, just as I thought, my husband was listed. Googled the phone number and it’s not a business number for Voya but a personal phone number for a very Google-able couple (maybe their phone number is being spoofed?) who seem like upstanding citizens based on a quick search. Neither, from what I gather, works for Voya so it’s not a case of someone working from home. Should I call Voya directly at this point? Change my passwords, etc.?