many years ago i had a call from my bank, I can verify now that it was a genuine call as they followed up with a letter.
basically i had gone overdrawn and they phoned me and wanted to take a payment into the account from another card, the first thing they asked was what was my security question, my response to this was, how do i know you are from my bank, you might be trying to scam me and get money from me, before i answer any questions that might compromise my account prove who you are, or send me a letter, they chose the letter. this as i say was years ago, just as the phone scams were starting, and banks expected to be able to call you and conduct business over the phone, of course nowadays they would do no such thing.