Even worse Morgan Stanley will ask you for two factor codes over the phone(!).

It’s impossible to implement good user behavior when the banks themselves are wildly negligent.

I tried to buy something, but it was a large amount - over my normal usage. I had to call the bank, and they said "we're sending a code to your phone..." and the text message said "DO NOT share this code. We will NEVER call you or text you for it. Code xxxxxx. Reply HELP if you didn't request it."

So... they then say "what is the code?" that specifically says "DO NOT share this code". I know what's going on, mostly, but it was still confusing.

It’s worth pointing out that if you are not the one initiating the call, then this is a legitimate attack vector, and not just via SMS text message or email two factor but also any type of OTP. The attack goes like this: (1) given that the whole point of two-factor auth is to prevent access to your account in the event that your primary authentication tokens (usually a username and password) are compromised, let’s assume for this attack that a bad actor already knows your username and password. (2) the attacker calls you up and says “this is <your bank>”, then (3) the attacker logs into your account with the username and password they already know (4) this either triggers an email or text message with the second factor, or if you use a hardware token or an app then the code is available there. Either way, the attacker requests you to read back the code over the phone (5) the attacker uses this secondary code to gain access to your account, and can then take any action including changing your password and 2nd factor setup. I think this is the reason security teams set up these messages to say things like “NEVER share this code!” and the like.

It was definitely poorly written. It's correct, since they never called you, it was you who called them. But it does raise the question as to how to teach people that who initiates the contact is very important and completely changes the security analysis.

The message should have read "You were speaking to one of our agents who indicated in the last minute or so they would send you a confirmation code. The code is XXXXX. Do not give this to anyone unless you initiated contact with our bank." Or... something closer to the actual scenario as it was playing out.

unfortunately, trust is a two way street!