Re: Dunce Cap tip
HSBC used to do something similar when I had a business account with them. They wanted the amount of a recent transaction for me to prove who I was!
I always told them I didn't believe they were who they said they were because I'd made it clear to my bank that I wouldn't accept such calls without a secure means of identifying themselves. If they were calling without such identification then they couldn't be my bank and I wouldn't even confirm if they'd guessed right. It was always followed up by a letter from them essentially saying how miffed they were that they hadn't been able to talk to me to sell me something.
I suppose I could have replied by giving them some random incorrect amount. Their recognition that it was incorrect would serve to identify them but I didn't particular want to take sales calls from them so why bother?