Yes, this is called WYSIWYS (what you see is what you sign) and I suffer whenever I receive a confirmation code saying absolutely nothing. However, when _you_ write the code to some trusted web app, there is that context, at least. But reading the code to some random person on the phone? No way!