>never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!

Some services even say that when they are indeed codes you are _supposed_ to read back to them. Which clearly helps further train people to ignore that language.