I'm convinced that the standard form of these text messages is wrong. A (legitimate) example I received recently read Your CorpName verification code is 3

I'm convinced that the standard form of these text messages is wrong. A (legitimate) example I received recently read Your CorpName verification code is 305825. Do not share this code. CorpName will never call you for this code. It's clear CorpName is trying to defend against this exact sort of attack in the last two sentences, but it's boilerplate we've all seen many times before. Who reads it anymore? The bigger problem is unaddressed: "ABC verification code" is vague. This is security information devoid of security context. A better written message would read, A computer in Seattle, WA is logging into your account on the CorpName website. If this is you, enter 384909 to authorize. Or, A wire transfer of $300 to X has been requested using your debit card ending in 9934. To authorize the transfer, enter 468909. I think asking people for authorization without atomically telling them what they're authorizing is properly viewed as a type of vulnerability.