Really what we need is reverse 2FA, when I'm on a call with someone who is asking for sensitive info I should be able to generate a 6 digit number in their app or website and request that they verify it, if they can't verify it, they're not with the bank. simple.
I had an issue where a bank (chase) called me to verify a transaction it felt was illegitimate, first thing the bank employee (who claimed to be with the fraud department) did was send me a SMS 2FA code that clearly said "do not share with ANYONE" I told him that and he said "yes, but I need it to confirm you are who I'm trying to reach, if you don't give it to me I will lock your account" ... My account was locked and I had to go into a branch, present 2 forms of photo ID to create a new userID and password and be able to use my cards/access my (new) account again.
I had some very strong words for the branch manager and anyone who would listen about how terrible a security practice it is to give those sorts of conflicting instructions.
I had an issue where a bank (chase) called me to verify a transaction it felt was illegitimate, first thing the bank employee (who claimed to be with the fraud department) did was send me a SMS 2FA code that clearly said "do not share with ANYONE" I told him that and he said "yes, but I need it to confirm you are who I'm trying to reach, if you don't give it to me I will lock your account" ... My account was locked and I had to go into a branch, present 2 forms of photo ID to create a new userID and password and be able to use my cards/access my (new) account again.
I had some very strong words for the branch manager and anyone who would listen about how terrible a security practice it is to give those sorts of conflicting instructions.