Had a fantastic example of this recently. I called my bank, for some reason they weren't able to connect me to the department I needed immediately, so I arranged to have them call me back when they were able to reach them. Little later, as expected, the bank call me back - same person I spoke to earlier, so I'm satisfied that it's the bank. She routes my call through to the department we needed to reach. That's where things get surreal, because that department isn't set up to have an outgoing call routed to them, so they decide they need to authenticate me.

The method they choose to do that, though, is to ask me for a phone number to which they can send an authentication code. I give them the phone number I'm using - the one they called me on. They ask if I want a text or a voice call. Tempting though it would be to put them on hold while I accept the voice call with the security code, I opt for the text message. Phone buzzes, I read out the number, and they seem happy with the result.

I really hope that when they asked me for a phone number they verified it against a list of known numbers associated with the account, but... it really wasn't clear in the context of the interaction.