Sometimes the best way to defang scams is to attack the social-factors and artificial-urgency they try to exploit.
In a similar vein, no legitimate institution should ever act punitively if you tell them that you're going to call them back through their official number/e-mail/site only.
Even that may be too complicated, now that I read it back.
A legitimate and generally well liked company, and its real helpful service representative used this method to verify my identify before they could finish their support effort.
On login:
Schwab Watch out for scams. DON'T share this security code with anyone, EVEN IF THEY CLAIM to be from Schwab. Your code for online login is XXXXXX
And then on a later phone call with an agent:
Schwab: XXXXXX is your Schwab security code to confirm your identity with the agent.
This is a nice touch, though I'm not sure how much it would help in a real scam situation for say, my grandma.
relaying security codes by voice is how the bad guys do it, dont train your users to think its normal.
its probably not a bright idea to have your phones camera pointed at your screen while 2FA-ing or password resetting, or else someone will watch you login, and will see your codes, and use automation to authenticate with your digits faster than you can move a cursor and click.
Hope you don't have to do 3D-Secure for a purchase, I guess.
Phone call caller ID is getting harder to spoof, with stir/shaken, but I'm not sure that's fully rolled out either... and calls from a 'random' number still get answered, so spoofing isn't needed for normal scams.
The solution is passkeys, which prevent phishing and more secure than passwords. I like how they replace SMS codes. But they are a pain to use and not that many sites support them. Every site that does 2FA should support them.
These things can fail 99.99% of the time but when they land on someone at just the right moment, it’s so easy to just go on autopilot and do the dumb thing.