For example, for online transactions, the SMS includes a warning to not share the code with anyone, while SMS codes for telephone banking tells you to share the number with the representative.
My bank uses a scanner to authorize pretty much all actions. It scans some sort of RGB QR code [0]. When scanned you'll see the IBAN you're sending the money to and the amount you're sending. I think that when the IBAN is in your contacts it shows the name instead of the IBAN.
But most importantly it shows a descriptive message of what action you're verifying. I think the only actions that don't require the scanner are small transactions through their app and marking your card as broken/stolen in the app.
[0] https://www.rabobank.nl/images/how_does_the_rabo_scanner_wor...
I think anyone building such systems (either via e-mail or SMS or whatever) should at least remember THIS.
Send something like this via SMS:
> The password reset code you requested via our website is 12345. We will never ask you for this code except when you requested a password reset.
1. What is requested 2. How was it requested 3. Is it safe to pass this to some other human being
Okay, 4. in better English ;) As opposed to:
> Your caller verification code is 12345, please read this code to your banking agent to verify your identity.
Also, ChipTAN is great: https://en.wikipedia.org/wiki/Transaction_authentication_num... If your bank would use this, it would be require extraordinary smart social engineering (or a really naive user).