One thing I wonder is if this works when you call Monzo as well - once you give them your details, does the same thing appear in the app? Because that opens the door for a man-in-the-middle attack. Actually, in that case it makes the attack so much worse, because it legitimises the attacker.