Ah, properly it's out of band authentication (OOBA). Hat tip to /u/Natanael_L on https://reddit.com/r/crypto https://reddit.com/r/crypto , who points out that a

Ah, properly it's out of band authentication (OOBA). Hat tip to /u/Natanael_L on https://reddit.com/r/crypto https://reddit.com/r/crypto , who points out that a bank would want to verify roles / job titles, not just the fact they both have employee userids.