There's a lot of institutional stupidity in banking, given that they need to verify the customer at the same time that the customer needs to verify the bank.

That said, the "call back" test is an easy smell test -- a bad actor will have a huge problem with that, while the bank usually won't think too much of it.