This type of stuff is diabolical for old folks who just weren't inoculated to these scams. I feel terrible for them. Get calls often asking me to help interpret.
Sometimes the best way to defang scams is to attack the social-factors and artificial-urgency they try to exploit.
In a similar vein, no legitimate institution should ever act punitively if you tell them that you're going to call them back through their official number/e-mail/site only.
Even that may be too complicated, now that I read it back.
A legitimate and generally well liked company, and its real helpful service representative used this method to verify my identify before they could finish their support effort.
On login:
Schwab Watch out for scams. DON'T share this security code with anyone, EVEN IF THEY CLAIM to be from Schwab. Your code for online login is XXXXXX
And then on a later phone call with an agent:
Schwab: XXXXXX is your Schwab security code to confirm your identity with the agent.
This is a nice touch, though I'm not sure how much it would help in a real scam situation for say, my grandma.
relaying security codes by voice is how the bad guys do it, dont train your users to think its normal.
its probably not a bright idea to have your phones camera pointed at your screen while 2FA-ing or password resetting, or else someone will watch you login, and will see your codes, and use automation to authenticate with your digits faster than you can move a cursor and click.
Hope you don't have to do 3D-Secure for a purchase, I guess.