“I’ve cancelled that charge and sent a new card out to you,” said Barry. “I’d like to enable enhanced security on your account, but I’ll need to text you a confirmation code first. Is that OK?”
I just had a bank’s fraud department send me an SMS code that I had to read back to them to verify myself to have my account unblocked from a fraud block that was incorrectly applied to my account. That’s Citi. So the banks are helping to create this problem.
Rather, my point was that, after solving the purported problem (the fraudulent transaction), moving on to enable some unspecified "security enhancement" was unnecessary and should have been suspect. Of course, there's no telling how someone would react in the heat of the moment.
This should have been the end of it.