That's the part the alerted me the most. You are always told to destroy the card, not even throw it away.

Getting the customer to call a number is another, they could have transferred the customer. Instead, they wanted to provide a shot of confidence before extracting info that no one, not even the bank should ask for.