Happy note: just had a sensible interaction with my bank where it called me back but the caller understood why NOT to ask data that could be used to access my account, and we managed to resolve the issue that I was having (which, I think, was my error)!