This is probably the best security technique in terms of simplicity vs effectiveness, one that everyone and their grandma can use. I wish there was more effort in educating people to use it.

I even remember a thread here in HN were one three-letter agency authenticated themselves to a user with this method, calling his numbers and saying, this is the FBI/NSA/etc but for you to be sure, please hang, look the website for the public number, call, and ask to be put through with $Agent from $Department.