>I’ve personally never had that happen. It should go on a name and shame list

The key situation for giving out an SMS code that the gp is pointing out is the customer initiates the call to the support center.

For example, suppose somebody wants to add a credit-card to their smartphone digital wallet. They have to call the bank issuing their credit-card to do that. Once the customer support person answers the call, a common security verification (e.g. Chase Bank does this) is for them to send you a 6 digit code to your phone. You then repeat this code back to the support person on the call. They want proof of your identity and also proof that you physically have the smartphone with you. Repeating the SMS code to the customer support person is safe because the customer called the official 1-800 number on the back of their card.

That's a totally different sequence of steps from receiving a random call from somebody claiming they are from Chase Bank. Yes, in those cases, you never give out SMS codes to that untrusted person on the phone.

Chase did this to me. A million alarm bells but even after hanging up and restarting the conversation from a phone number publicly listed on their website as a support contact they still did it. Wild.

Stripe Support does it for certain specific cases (email & phone). However, whenever they do it, it's a bilateral code generation: The support agent also gets a code they have to read out to the end user, which is featured prominently to them, saying the agent will have to read it out to get authentified.

Fidelity does as well, although the message switches to state only read the code if you've called them directly.

A lot of credit unions using a certain call center / credit card provider use this exact authentication mechanism over the phone.

My bank does it. Chase will send OTP via the bank app to verify you're identity for phone support.

Chase bank…

  - godaddy