voice calls...
I don't know. I place a very high value on voice calls.
For the moment, anyways, they are very difficult to fake and because of interactivity, if there is any suspicion, the appropriate queries can be made verbally in real time.
I received one of those 'Beware of XXX chain emails' if you like. I hate these things. Thanks very much whomever sent it to me, I deleted it on sight but after just a very cursory skim, it actually carried a message of some value.
Went something like this: some fella got pickpocketted, ATM card, mobile phone and all and the clever perp actually text-ed his wife with the mobile pretending to be him stating he'd forgotten some code - I believe it was the ATM pin from memory and apparently the wife texted it back and because of that he lost whatever the daily withdrawal limit was.
And just remember what happened to HBGarry.
"Never underestimate the stupidity of the end user" Isn't that one of those engineering maxims? I would add an "and yourself" to the end of it, lord knows, I've done some stupid things in the past, and who here hasn't?
So, I guess I'm saying a voice call is just a little bit more difficult to social engineer, if the person you're calling recognizes your voice.