> If someone on the phone
Not "someone". Me. They happily secure phone actions by both a password and 2FA just like online access. After that point you can do literally anything else with the account, including close it or get a copy of the card details.
Thwarting the verified owner of the account is not fraud prevention.
On the subject of thwarting and card details, though, neither CapitalOne's website nor mobile app will show my card number nor will they let me create temporary card numbers _after_ I've authenticated with a strong password and 2FA whenever I happen to be outside of the country. It just says "Oops, something went wrong". It took me weeks to figure out the first time that it was because I wasn't on a US network.