The trouble is, viper that these customers had been visited the previous day by an engineer from TT, and told to expect a follow-up call. The caller gave them the name of the engineer from the previous day, and details of the problem, and in one case, the reference ID for the visit.
Given all this, it isn't unreasonable for them to have believed that the caller was genuine - they weren't using basic information which could have been obtained in the leak last year, the caller clearly had access to live systems, or at the very least, overnight backups.
I think their only mistake was in expecting TT to call them back within a reasonable time.