Giving them the benefit of the doubt, if they're asking for a phone password, hopefully they're just keying it into their systems for verification against a hash, not manually comparing to a plaintext copy.