> _always_ verify and call the number back

Fine in principle, but banks do call, and often have no direct dial, as a matter of policy, for whoever you're speaking to.

So it becomes verify the number, call back, and spend 30+ minutes in a queuing system before some lowly call centre worker on another continent incorrectly tells you they can't connect you to the xyz department.

It used to work before call centres and all the small banks became just branding on the front of one of the big 4. You were even allowed the phone number of the local branch! That's the UK market btw.