This is a great comment. It is this kind of social engineering attack which is unbelievably effective, simply because most people don't want to offend the other

This is a great comment. It is this kind of social engineering attack which is unbelievably effective, simply because most people don't want to offend the other person at the other end of the phone. Banks really need to stop phoning people like this. A simple way to do this would be to have a TOTP type password that the caller needs to confirm with the callee, regardless of which direction the call is going on; bank to customer, or customer to bank. As a customer you should be able to ask the bank representative for the shared password and if they can't answer the question then you should call your bank immediately to warn then.