As long as you actually tell them that they have the wrong number, that the person they are calling for doesn't live there, they will note the acct and "bad" it out. Just telling them "stop calling" and hanging up won't do anything because they didn't find out the person can't be reached at this number.
Also, just because you tell them don't call this number anymore or you'll call your atty won't do any good unless you are in certain states. Surprisingly, most States do not have verbal cease and desist laws, therefore your request won't be taken as such.
Another thing, the Nat'l do not call list doesn't matter to these calls, they are not solicitations, but rather business calls, which aren't a factor in the list.
As for the phishing scam, most credit card companies have procedures in place where, in order to verify your contact information, they ask you to repeat it back to them. The idea is they don't want to be responsible if they tell your address to someone and somehow they manage to use it for fraud purposes. Just let them know you won't read it back and they should now at least give you some if not all of it for you to confirm.
If you ever leery of someone calling you, you can always request they give you information about the acct in order to verify there authenticity. Another way is, after you speak to one of these people, you can always call the Cust Serv # on the back of your card and see if they have a record of the call.