BofA called me a couple months back after locking my account (apparently buying gas in a town 45 minutes away where I have an alternate address trips their fraud detection) and the convo literally went like this
lady: Hi this is lady from BofA, is this XXXX?
me: Yes
lady: your account has been locked due to suspicious activity, can you give me your card number please?
me: Uhh, shouldn't there be some sort of confirmation or something?
lady: What do you mean?
me: Don't you need to ask me a pin number or secret question or something? Does saying I'm me really count? This is possible fraud we're dealing with after all, and how do I know you are who you say you are? Why would you be asking me for my card number anyway? That's like asking me for my account password
lady: uhh, well you can just call the number on the back of your card
This dumb broad couldn't fathom how someone might be wary about giving their CC number over the phone to a stranger who hasn't attempted to confirm who they are nor who you are, much less to someone who if they are who they say they are should have all that information anyhow
So I called the number on the card and they verified me and them both ways so it was all good.