This sounds like as much of an defence against internal attacks than against scammers. Though it might be helpful if the customer noticed the attacker didn't a

This sounds like as much of an defence against internal attacks than against scammers. Though it might be helpful if the customer noticed the attacker didn't ask for the confirmation and became suspicious, but that's probably a small number of people and scammers are very good at allaying such worries with plausible excuses.