Comment by SpoonMeiser

HSBC are also (or at least were very recently) in the habit of calling customers and launching immediately into security questions without even identifying themselves first, which is wrong for all sorts of reasons.