Yeah NatWest are majorly guilty of this. They used to phone me with a script that was like:

NW: "Hello, am I speaking to <robotmay>?"

Me: "Who's asking?"

NW: "I'm calling from the NatWest fraud team, we'd like to verify your transactions. First we need to ask some security questions: what is your account number?"

Me: :|

Online-only banks like Monzo/Starling are better at this aspect - they never seem to phone anyone, which at this point I'd consider a security feature.