This is silly. If the person believed this was the bank the 3rd code would be used. Best answer is don't answer phone calls and force people to send letters.