For those who don't know it, our tax id (CPF) is basically public information. For instance: we just had an election. The official public site with the official information about all the candidates (https://divulgacandcontas.tse.jus.br/) has the CPF for all of them. Want to know our president's CPF? It's there.

The bad part is the rest. Having the name together with the phone number, plus being on the list meaning you most likely have one of a particular set of products from Caixa, makes it much easier for the scammers to pretend to be from the bank.