Most corporations don't behave particularly responsibly in terms of your data security, and the financial industry is one of the worst when it isn't an issue th

Most corporations don't behave particularly responsibly in terms of your data security, and the financial industry is one of the worst when it isn't an issue that they are statutorily liable for. So you end up with odd extremes where credit card fraud is treated with extreme care (statutorily liable > $50) and business banking is usually secured quite poorly (no liability, typically). It's up to you to provide or ask for any extra security measures you find appropriate, like asking to call them back. Anyone using common security questions is already balancing a risky behavior with ease of use. They might also know that risk is low - if they don't allow any difficult to reverse transactions like outbound fedwire there may not be a lot they can't easily undo.