It's not the first time I've heard of a scam like this. Scammers are increasingly sophisticated about this, basically performing a kind of man-in-the-middle attack on the phone between you and your bank. And phone protocols aren't secure enough to deal with this.