These things can fail 99.99% of the time but when they land on someone at just the right moment, it’s so easy to just go on autopilot and do the dumb thing.
Sometimes the best way to defang scams is to attack the social-factors and artificial-urgency they try to exploit.
In a similar vein, no legitimate institution should ever act punitively if you tell them that you're going to call them back through their official number/e-mail/site only.
Even that may be too complicated, now that I read it back.
A legitimate and generally well liked company, and its real helpful service representative used this method to verify my identify before they could finish their support effort.
On login:
Schwab Watch out for scams. DON'T share this security code with anyone, EVEN IF THEY CLAIM to be from Schwab. Your code for online login is XXXXXX
And then on a later phone call with an agent:
Schwab: XXXXXX is your Schwab security code to confirm your identity with the agent.
This is a nice touch, though I'm not sure how much it would help in a real scam situation for say, my grandma.
relaying security codes by voice is how the bad guys do it, dont train your users to think its normal.
its probably not a bright idea to have your phones camera pointed at your screen while 2FA-ing or password resetting, or else someone will watch you login, and will see your codes, and use automation to authenticate with your digits faster than you can move a cursor and click.
Hope you don't have to do 3D-Secure for a purchase, I guess.
Phone call caller ID is getting harder to spoof, with stir/shaken, but I'm not sure that's fully rolled out either... and calls from a 'random' number still get answered, so spoofing isn't needed for normal scams.
The solution is passkeys, which prevent phishing and more secure than passwords. I like how they replace SMS codes. But they are a pain to use and not that many sites support them. Every site that does 2FA should support them.