It is possible to make it secure. "Hi, this is SomeDude from Bank of America, and we noticed some suspicious activity on your account. Please go to the Bank of America website and find the number labeled 'Customer callback number' and call us there. That way, you can confirm you're talking to us, at which point we will confirm your identity, and then work with you on the issue."

I've seen this proposed. I don't know if anyone is actually doing it.