Confirm iPhone Passcode

It is a scam.

Did you provide any potentially damaging information to anyone? If yes, you'll need to follow up, for example, with a credit card company, Apple, your bank, etc.

If you gave you Apple ID password to a scammer, then

Change your Apple ID password https://support.apple.com/en-us/HT201355

Here is What to do [before] or after you change your Apple ID or password https://support.apple.com/en-us/HT204071

See If you think your Apple ID has been compromised https://support.apple.com/en-us/HT204145to see what to do.

Increase the Security of your Apple ID https://support.apple.com/en-us/HT201303

iCloud security overview  https://support.apple.com/en-us/HT202303

Ways to keep your information safe on Mac https://support.apple.com/en-gb/guide/mac-help/mh11402/mac

FYI: 

See If you see apple.com/bill, itunes.com/bill, or an unfamiliar charge on your statement https://support.apple.com/en-us/HT201382

See Identify legitimate emails from the App Store or iTunes Store https://support.apple.com/en-us/HT201679

For scam related information from Apple including reporting scams to Apple see Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams https://support.apple.com/en-us/HT204759

It wants your passcode to protect your data stored in iCloud. This isn't unusual.

Yes, Apple would not contact you like that. You should be OK if you did provide any potentially damaging information to anyone or give you Apple ID password to anyone.