The message should have read "You were speaking to one of our agents who indicated in the last minute or so they would send you a confirmation code. The code is XXXXX. Do not give this to anyone unless you initiated contact with our bank." Or... something closer to the actual scenario as it was playing out.