What is the best practice for preventing these man in the middle (MITM) attacks? Brian Krebs seems to suggest the only way of doing so using a phone alone is to

What is the best practice for preventing these man in the middle (MITM) attacks? Brian Krebs seems to suggest the only way of doing so using a phone alone is to put down the phone and ring back, that way the initiation of the connection can be guaranteed to be secure. I suspect there are better schemes that can be adopted when the user has access to both a phone and another connected device that can foil MITM attacks using SSL but you can't always guarantee that a user has access to a web browser or app. In this case all phone calls from the bank should proceed like so (and it should be made illegal to act otherwise): "Hi I'm calling from Example Bank fraud department. Please go to your banking details and find the phone number for the fraud department and call the number listed and quote the reference ABC. I will now hang up and await your callback"