That's good, didn't catch the irony right away.
I really wish companies would allow us to refuse this to be possible except in person.
If you find someone's wallet and phone it's just too easy in most cases. Sometimes you don't even need either, you just gotta be sure they are unable to answer their phone at the moment.
Here it is usually through bank sign-in codes, which are one off use - or authenticator apps.