The passcode to call your bank for basic customer service probably shouldn’t be the same passcode that lets people spend money on your account. Even TOTP is better than this.

Why not?

Basic customer service lets you do things like transfer money too, so you need something just as secure as a PIN.

So why would you want two different security mechanisms? Either it's you or it's not.

In the UK customer service absolutely cannot transfer money

The banking system is so backwards in the US it's actually insane, you've just got used to it

It's teaching people to handover their pin code on the phone. It goes against their own security advice of never handing over CC details on the phone

> You're the one calling them, so it's fine.

Again, normalizing handing over complete CC details on the phone makes it much easier for scammers calling to succeed in asking for those details.

For one thing, DTMF codes are intentionally distinct and easy to pick up and decode within a decent radius of the device.