Businesses that expect me to hand over PII when they call me certainly do get upset when I point out that I have no idea who THEY are, and that THEY called me so the onus is on them to prove who they are (typically they will claim their phone number is enough, or that I should ring the phone number that they provide).

The actual truth is, though, that the security theatre that they put on is about all that can be done when two strangers meet to prove identity.

Hey you do you know a secret that we know about you? Here's a secret about us that you are supposed to know.