Natwest seems to have taken to sending me text messages listing three recent transactions (where one is suspicious to them), and asking did you make these? Reply y or n.

I can't verify that the text is from Natwest, but it seems relatively safe, as I'm not providing any personal information in return, so this seems a reasonable first line security mechanism. Of course someone could clone my SIM, in which case there's no protection, but it does raise the bar for using a stolen cards, and I think that's the intent.

If my bank ever does call me, they have to leave voicemail because I don't answer calls from unknown numbers. And then I call back using the number on the back of the card.