Even that may be too complicated, now that I read it back.
A legitimate and generally well liked company, and its real helpful service representative used this method to verify my identify before they could finish their support effort.
relaying security codes by voice is how the bad guys do it, dont train your users to think its normal.
its probably not a bright idea to have your phones camera pointed at your screen while 2FA-ing or password resetting, or else someone will watch you login, and will see your codes, and use automation to authenticate with your digits faster than you can move a cursor and click.
On login:
Schwab Watch out for scams. DON'T share this security code with anyone, EVEN IF THEY CLAIM to be from Schwab. Your code for online login is XXXXXX
And then on a later phone call with an agent:
Schwab: XXXXXX is your Schwab security code to confirm your identity with the agent.
This is a nice touch, though I'm not sure how much it would help in a real scam situation for say, my grandma.
Hope you don't have to do 3D-Secure for a purchase, I guess.