Yes, there are plenty of way to check the call is genuine - asking for some information that only the train company would know (as mentioned above), or even calling them back yourself (to a number on their website, not one they give you in the call). I'm just amazed that any company these days would make their default position exactly mimic what a fraudster would do - each time a company does this it reinforces in the customer's mind that such a situation is normal and safe - increasing the chance that one day they will get caught out by a phishing attack.
With regards to asking for the card number when making the claim and not being allowed to store these details, they (Great Northern at least) ask for payment details with online Delay Repay claims (or they did at some point in the past - I admit I've gone back to the paper form in recent times because it's *so* much simpler to fill in than an online claim, so I don't know if they still do). I don't see what the difference is between an online Delay Repay claim and an online season ticket refund claim in this regard.
As to whether asking for start/end stations on the ticket, or the amount of the refund, is enough to verify the caller is genuine: if your tcket is to an obscure destination and bought on a random date in the middle of the year then maybe it is. I think I'd be asking for something like the photocard number or ticket number as well. If I were a fraudster, I'd be calling random numbers within a city just outside London, quoting a season ticket from there to London Terminals, and quoting a price/refund amount assuming the ticket was bought on 31st December. I'll be right some of the time, and if I'm making 60-second anonymous phone calls to try and con people then I only need a tiny success rate for it to be worthwhile.