This is normal. I had an account with a major U.S. bank, and they would routinely have their automated system ask you for your debit card number and PIN. The concept is that you have specifically called a trusted number, usually written on your debit or credit card or account statement, and therefore this is usually as trustworthy as your phone network is.
As to whether mobile phone networks are securely encrypted, the answer is usually that they are not. Typically the algorithms used in them have not stood up well to cryptanalysis, mostly because the standards bodies have decided to invent their own algorithms rather than use well-known algorithms and modes. As a result, and additionally due to the requirements for lawful interception of phone calls in virtually every country, you should assume that your phone calls are not private to a dedicated party, but are generally not trivially interceptable to arbitrary busybodies.
However, if you have concerns about communicating private data like this over a phone line, then you should not use the phone for private data. My assumption has been that the bank is legally liable for fraud and acting on unauthorized instructions (which, in the U.S., it is for consumers), and thus they have borne the entire consequence of this insecurity. In addition, it is practically difficult to solve many problems requiring the use of private information without the use of a phone line, so until the telephone companies come into the 2020s, we're just going to have to live with it. It will likely take either expensive litigation or regulation to get there, though.
You may wish to use your bank's live chat service via their website, which typically uses TLS 1.2 or 1.3 and is going to be securely encrypted. That's mostly due to various browser vendors who have been pushing for robust encryption.
